- Add security response headers on every response: Content-Security-Policy
  (source allowlist), X-Frame-Options, X-Content-Type-Options, Referrer-Policy,
  Permissions-Policy, COOP, HSTS. Verified Firebase/fonts/socket.io still work
  with zero CSP violations.
- Replace hardcoded Flask secret_key with SECRET_KEY env / per-process random.
- Add a smoke test asserting headers + non-hardcoded key.
- README: document application hardening + source/IP protection guidance.