fix(api): add default security headers

[thomasorgeval]

Summary

• Add API-wide browser hardening headers for content sniffing, referrer leakage, framing, and sensitive browser capabilities.
• Replace the upload-only nosniff hook with a reusable Hono middleware.
• Cover the middleware with a focused Vitest regression test.

Expected impact

• Reduces clickjacking exposure on API/auth responses.
• Keeps uploaded logo responses protected by nosniff while extending the same default to every API response.
• Narrows passive browser data leakage via referrer and permissions defaults without changing API behavior.

Verification

• pnpm nx test api
• pnpm nx lint api
• pnpm nx typecheck api
• pnpm format:check apps/api/src/app.ts apps/api/src/http/security-headers.ts apps/api/src/http/security-headers.spec.ts
• pnpm nx build api