security: add privacy and browser security headers

[hsyntax]

Risk

Shared diffs are bearer-link content. Responses currently do not consistently opt out of browser/proxy caching or restrict framing, referrer leakage, and browser capabilities.

Scope

Apply appropriate headers to HTML, shared-diff data, and API responses:

• Cache-Control: private, no-store for shared content
• Referrer-Policy: no-referrer
• X-Content-Type-Options: nosniff
• CSP with frame-ancestors none, compatible with TanStack hydration and the diff worker
• restrictive Permissions-Policy
• HSTS in production

Acceptance criteria

• Shared diff HTML and data responses cannot be cached.
• The app cannot be framed by another origin.
• CSP permits only the resources required by the app.
• Header behavior is covered by automated tests and documented.