feat(security): ship and verify production security headers

[carelessdept]

Closes #187

Summary

• Defines canonical production security headers (Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy) and route-specific cache/content-type rules in src/utils/security-headers.ts and vercel.json.
• Applies route-appropriate headers across:
  • Pages & Edge Bot Rewrites (/(.*), middleware.ts): PAGE_SECURITY_HEADERS with a CSP compatible with self-hosted fonts (/fonts/*, data:), Plausible analytics (https://plausible.io), Soroban/Horizon RPC & status endpoints, inline critical CSS, and generated JSON-LD.
  • Feeds & XML (/feed.xml, /feed/tag/(.*), /sitemap.xml): application/rss+xml; charset=utf-8 / application/xml; charset=utf-8, public, max-age=3600, s-maxage=3600, stale-while-revalidate=86400, and FEED_CONTENT_SECURITY_POLICY.
  • Static Assets (/assets/(.*), /fonts/(.*), /og/(.*), /press-kit/(.*), /press-kit.zip): immutable 1-year caching for fingerprinted bundles and fonts (Access-Control-Allow-Origin: * on /fonts/*), and max-age=86400, stale-while-revalidate=604800 for OG/press-kit assets.
  • API Responses (/api/subscribe, /api/og): strict default-src 'none'; frame-ancestors 'none' CSP, Cache-Control: no-store and Referrer-Policy: no-referrer on /api/subscribe, and immutable PNG caching with security headers on /api/og.
• Mirrors vercel.json header behavior in scripts/preview-server.ts, middleware.ts, api/subscribe.ts, and src/api/og.tsx.
• Adds unit and smoke verification tests in src/__tests__/security-headers.test.ts, tests/subscribe.test.ts, and tests/smoke/serverless.smoke.test.ts (supporting both the local preview smoke server and deployed previews via PREVIEW_URL).

Verification

• pnpm format:check
• pnpm lint:i18n
• pnpm validate:content
• pnpm build
• pnpm validate:jsonld
• pnpm test
• pnpm test:smoke

[vercel]

@carelessdept is attempting to deploy a commit to the truthixify's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@carelessdept Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[truthixify]

Route-specific security headers, serverless smoke coverage, and the production build all pass locally. Approved.