feat(web-next): wire security headers middleware and nonce threading

- Add apps/web-next/middleware.ts calling withSecurityHeaders() from
  core-shared/security/next; exports matcher config excluding static assets
- Update layout.tsx to call getNonce() and render <meta name="csp-nonce">
  so client-side JS can read the per-request nonce
- Update instrumentation-client.ts to read nonce from csp-nonce meta tag
  and pass it to initSentryClient for feedbackIntegration CSP compliance
- Add nonce option to initSentryClient (InitClientOpts.nonce) and thread
  styleNonce + scriptNonce into feedbackIntegration when provided
- Add middleware test asserting all six headers, prod/dev CSP shape, and
  x-nonce presence; add feedbackIntegration nonce tests to core-shared

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coverage/summary.json

@@ -1,16 +1,16 @@
 {
-  "generatedAt": "2026-05-20T09:55:49.120Z",
-  "commit": "6903c59",
+  "generatedAt": "2026-05-20T10:09:50.939Z",
+  "commit": "de458a6",
   "repo": {
     "statements": 97.43,
-    "branches": 92.56,
+    "branches": 92.57,
     "functions": 97.28,
     "lines": 97.43,
     "counts": {
       "lf": 6079,
       "lh": 5923,
-      "brf": 1223,
-      "brh": 1132,
+      "brf": 1224,
+      "brh": 1133,
       "fnf": 368,
       "fnh": 358
     }
@@ -102,14 +102,14 @@
     },
     "@repo/core-shared": {
       "statements": 98.39,
-      "branches": 96.47,
+      "branches": 96.48,
       "functions": 93.5,
       "lines": 98.39,
       "counts": {
         "lf": 1304,
         "lh": 1283,
-        "brf": 368,
-        "brh": 355,
+        "brf": 369,
+        "brh": 356,
         "fnf": 123,
         "fnh": 115
       }