feat(core-shared): add Next.js security header middleware adapter

Implements security/next subpath with withSecurityHeaders() middleware
and getNonce() Server Component helper. Middleware generates a per-request
nonce, calls buildSecurityHeaders, sets all six headers + x-nonce on the
response, and forwards the nonce via request headers for Server Component
access. Adds next as optional peer + dev dependency.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coverage/summary.json

@@ -1,18 +1,18 @@
 {
-  "generatedAt": "2026-05-20T09:32:45.528Z",
-  "commit": "650a97b",
+  "generatedAt": "2026-05-20T09:45:48.959Z",
+  "commit": "6575a48",
   "repo": {
-    "statements": 97.42,
-    "branches": 92.47,
-    "functions": 97.25,
-    "lines": 97.42,
+    "statements": 97.43,
+    "branches": 92.51,
+    "functions": 97.27,
+    "lines": 97.43,
     "counts": {
-      "lf": 6040,
-      "lh": 5884,
-      "brf": 1209,
-      "brh": 1118,
-      "fnf": 364,
-      "fnh": 354
+      "lf": 6063,
+      "lh": 5907,
+      "brf": 1215,
+      "brh": 1124,
+      "fnf": 366,
+      "fnh": 356
     }
   },
   "byPackage": {
@@ -101,17 +101,17 @@
       }
     },
     "@repo/core-shared": {
-      "statements": 98.34,
-      "branches": 96.33,
-      "functions": 93.28,
-      "lines": 98.34,
+      "statements": 98.37,
+      "branches": 96.39,
+      "functions": 93.39,
+      "lines": 98.37,
       "counts": {
-        "lf": 1265,
-        "lh": 1244,
-        "brf": 354,
-        "brh": 341,
-        "fnf": 119,
-        "fnh": 111
+        "lf": 1288,
+        "lh": 1267,
+        "brf": 360,
+        "brh": 347,
+        "fnf": 121,
+        "fnh": 113
       }
     },
     "@repo/core-ui": {