Infrastructure — Security Headers

CSP, HSTS, Permissions-Policy reference for all surfaces.

Content pending

Per-surface header configuration. Cross-reference with architecture/security/.