Implements security/next subpath with withSecurityHeaders() middleware and getNonce() Server Component helper. Middleware generates a per-request nonce, calls buildSecurityHeaders, sets all six headers + x-nonce on the response, and forwards the nonce via request headers for Server Component access. Adds next as optional peer + dev dependency. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>