feat(web-tanstack): wire security headers middleware and nonce threading

Register core-shared/security/tanstack server middleware in app.config.ts
as a Nitro/H3 hook that emits the six security headers and forwards the
per-request nonce. Update instrumentation-client to read the nonce from
<meta name="csp-nonce"> and pass it to initSentryClientReact.

Add nonce support to initSentryClientReact (feedbackIntegration receives
styleNonce/scriptNonce), mirroring the initSentryClient pattern already
in place for web-next.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coverage/summary.json

@@ -1,16 +1,16 @@
 {
-  "generatedAt": "2026-05-20T10:09:50.939Z",
-  "commit": "de458a6",
+  "generatedAt": "2026-05-20T10:32:38.076Z",
+  "commit": "dc718fd",
   "repo": {
     "statements": 97.43,
-    "branches": 92.57,
+    "branches": 92.56,
     "functions": 97.28,
     "lines": 97.43,
     "counts": {
       "lf": 6079,
       "lh": 5923,
-      "brf": 1224,
-      "brh": 1133,
+      "brf": 1223,
+      "brh": 1132,
       "fnf": 368,
       "fnh": 358
     }
@@ -102,14 +102,14 @@
     },
     "@repo/core-shared": {
       "statements": 98.39,
-      "branches": 96.48,
+      "branches": 96.47,
       "functions": 93.5,
       "lines": 98.39,
       "counts": {
         "lf": 1304,
         "lh": 1283,
-        "brf": 369,
-        "brh": 356,
+        "brf": 368,
+        "brh": 355,
         "fnf": 123,
         "fnh": 115
       }