feat(web-next): wire security headers middleware and nonce threading

- Add apps/web-next/middleware.ts calling withSecurityHeaders() from
  core-shared/security/next; exports matcher config excluding static assets
- Update layout.tsx to call getNonce() and render <meta name="csp-nonce">
  so client-side JS can read the per-request nonce
- Update instrumentation-client.ts to read nonce from csp-nonce meta tag
  and pass it to initSentryClient for feedbackIntegration CSP compliance
- Add nonce option to initSentryClient (InitClientOpts.nonce) and thread
  styleNonce + scriptNonce into feedbackIntegration when provided
- Add middleware test asserting all six headers, prod/dev CSP shape, and
  x-nonce presence; add feedbackIntegration nonce tests to core-shared

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-shared/src/instrumentation/sentry/init-client.test.ts

@@ -1,17 +1,22 @@
 // packages/core-shared/src/instrumentation/sentry/init-client.test.ts
 import { describe, it, expect, vi, beforeEach } from "vitest";
 
-const { replayIntegration } = vi.hoisted(() => {
+const { replayIntegration, feedbackIntegration } = vi.hoisted(() => {
   const replayIntegration = vi.fn((opts: unknown) => ({
     name: "Replay",
     _opts: opts,
   }));
-  return { replayIntegration };
+  const feedbackIntegration = vi.fn((opts: unknown) => ({
+    name: "Feedback",
+    _opts: opts,
+  }));
+  return { replayIntegration, feedbackIntegration };
 });
 
 vi.mock("@sentry/nextjs", () => ({
   init: vi.fn(),
   replayIntegration,
+  feedbackIntegration,
 }));
 
 import * as Sentry from "@sentry/nextjs";
@@ -65,4 +70,29 @@ describe("initSentryClient", () => {
     initSentryClient({ dsn: "", app: "web-next" });
     expect(Sentry.init).not.toHaveBeenCalled();
   });
+
+  it("attaches feedbackIntegration when Sentry.feedbackIntegration is available", () => {
+    initSentryClient({ dsn: "https://x@y/1", app: "web-next" });
+    expect(feedbackIntegration).toHaveBeenCalledTimes(1);
+  });
+
+  it("passes styleNonce and scriptNonce to feedbackIntegration when nonce provided", () => {
+    initSentryClient({
+      dsn: "https://x@y/1",
+      app: "web-next",
+      nonce: "abc123",
+    });
+    const feedbackOpts = (feedbackIntegration as ReturnType<typeof vi.fn>).mock
+      .calls[0]![0] as Record<string, unknown>;
+    expect(feedbackOpts["styleNonce"]).toBe("abc123");
+    expect(feedbackOpts["scriptNonce"]).toBe("abc123");
+  });
+
+  it("omits nonce props from feedbackIntegration when nonce not provided", () => {
+    initSentryClient({ dsn: "https://x@y/1", app: "web-next" });
+    const feedbackOpts = (feedbackIntegration as ReturnType<typeof vi.fn>).mock
+      .calls[0]![0] as Record<string, unknown>;
+    expect(feedbackOpts["styleNonce"]).toBeUndefined();
+    expect(feedbackOpts["scriptNonce"]).toBeUndefined();
+  });
 });

packages/core-shared/src/instrumentation/sentry/init-client.ts

@@ -16,6 +16,7 @@ export type InitClientOpts = {
   dsn: string | undefined;
   app: "web-next" | "cms" | "web-tanstack";
   release?: string;
+  nonce?: string;
 };
 
 // Inline scrub helpers for browser-side Sentry (server uses OTel processors instead).
@@ -70,6 +71,7 @@ function scrubUrl(url: string): string {
 
 export function initSentryClient(opts: InitClientOpts): void {
   if (!opts.dsn) return;
+  const { nonce } = opts;
 
   const isProd = process.env["NODE_ENV"] === "production";
   const tracesSampleRate =
@@ -127,6 +129,13 @@ export function initSentryClient(opts: InitClientOpts): void {
         maskAllInputs: true,
         blockAllMedia: true,
       }),
+      ...(Sentry.feedbackIntegration
+        ? [
+            Sentry.feedbackIntegration({
+              ...(nonce ? { styleNonce: nonce, scriptNonce: nonce } : {}),
+            }),
+          ]
+        : []),
     ],
     initialScope: { tags: { app: opts.app } },
   });