fix(security): enforce scoped content security policy on docs route

[mopxam-art]

Why

Content-Security-Policy was entirely disabled for all routes matching /docs to allow Swagger UI initialization scripts to run. While other security headers remained active, disabling CSP completely left the documentation surface without origin and object containment.

What

• Introduced DEFAULT_CSP_DIRECTIVES and scoped DOCS_CSP_DIRECTIVES in src/middleware/securityHeaders.ts.
• Permitted required inline script execution and asset origins (https://unpkg.com, https://validator.swagger.io) specifically on /docs while strictly maintaining object-src 'none', frame-ancestors 'none', base-uri 'self', and form-action 'self'.
• Scoped docs CSP detection to /docs and /docs/ subpaths, ensuring raw API routes like /docs.json retain default strict CSP without inline script permissions.
• Removed the manual res.removeHeader("Content-Security-Policy") hook from src/index.ts.

Verified

• Added unit tests in src/__tests__/securityHeaders.test.ts (102 passing) asserting CSP header presence, directive structure across routes, HTTP methods, and rapid sequential requests.
• Typecheck (npx tsc --noEmit) and linter pass with 0 errors.
• Production build (npm run build) succeeded.

Closes #924

Payout coordinate:
USDC (EVM / Base / Arbitrum / ERC20): 0x387c064ccf729a4846b62e95dc6b70e4d4c41e73