fix(security): enforce browser headers for SPA and API

[bestony]

Closes #1541

Summary

• Add enforced app-wide CSP and browser security headers at the Fastify root before API, WebSocket, and static registrations. The policy covers SPA, API, health, asset, 404, and bodyless responses.
• Move GA4, Clarity, and theme initialization to an external browser bootstrap so the shipped HTML has no inline scripts and script-src has no unsafe inline/eval sources.
• Add strict, exact-origin CSP configuration with JSON/comma-separated environment values, explicit regional Clarity endpoints, analytics/avatar defaults, and deployment guidance for Sentry and future object storage.
• Add product tests and a cross-surface QA case; remove the attachment-only nosniff setter now that the header is global.

Verification

• pnpm check passes with the repository's existing warnings only.
• pnpm typecheck passes (10/10 tasks).
• Shared: 63 test files, 704 tests passed.
• Server: 689 test suites, 2675 tests passed.
• Web: 204 test files, 1736 tests passed.
• QA package: 4 tests passed.
• Targeted security, analytics, attachment, and build-app tests pass.

The formal Docker/browser pass from the new QA case was not run in this local turn; it remains the maintainer-run validation for login, chat, WebSocket updates, avatars, attachments, document preview, and browser-console CSP violations. The parallel root Turbo test run also hit a Vitest worker onTaskUpdate timeout in an unrelated CLI portable-S3 test; the same test passes in an isolated 12/12 run.

The PR is intentionally draft for the GoF competition and must remain draft.