Add HTTP Security Headers to next.config.js

Description

next.config.js currently sets zero HTTP security headers. Every response is missing headers that modern browsers use to enforce content restrictions, prevent clickjacking, and block MIME sniffing. This is one of the lowest-effort, highest-impact security improvements available.

Associated Epic: #346

Subtasks

Add a headers() export to next/next.config.js that applies to all routes ('/')
X-Frame-Options: DENY — prevents the site from being embedded in iframes (clickjacking)
X-Content-Type-Options: nosniff — prevents browsers from MIME-sniffing responses
Referrer-Policy: strict-origin-when-cross-origin — limits referrer information sent cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=() — disables unused browser APIs
Strict-Transport-Security: max-age=31536000; includeSubDomains — enforce HTTPS for 1 year (production only)
Content-Security-Policy — must explicitly allowlist:
- self for scripts, styles, and images
- https://lh3.googleusercontent.com for Google profile images
- .s3..amazonaws.com and *.s3.amazonaws.com for S3 assets (already in remotePatterns)
- https://accounts.google.com for OAuth
Test CSP in report-only mode first to catch violations before enforcing

Acceptance Criteria

curl -I https://[production-url]/ shows all six headers present
No legitimate app functionality is broken by the CSP (OAuth, S3 images, Google fonts all still load)
HSTS header is only set when NODE_ENV === production

# Add HTTP Security Headers to next.config.js ## Description next.config.js currently sets zero HTTP security headers. Every response is missing headers that modern browsers use to enforce content restrictions, prevent clickjacking, and block MIME sniffing. This is one of the lowest-effort, highest-impact security improvements available. Associated Epic: #346 ## Subtasks - [ ] Add a headers() export to next/next.config.js that applies to all routes ('/') - [ ] X-Frame-Options: DENY — prevents the site from being embedded in iframes (clickjacking) - [ ] X-Content-Type-Options: nosniff — prevents browsers from MIME-sniffing responses - [ ] Referrer-Policy: strict-origin-when-cross-origin — limits referrer information sent cross-origin - [ ] Permissions-Policy: camera=(), microphone=(), geolocation=() — disables unused browser APIs - [ ] Strict-Transport-Security: max-age=31536000; includeSubDomains — enforce HTTPS for 1 year (production only) - [ ] Content-Security-Policy — must explicitly allowlist: - self for scripts, styles, and images - https://lh3.googleusercontent.com for Google profile images - *.s3.*.amazonaws.com and *.s3.amazonaws.com for S3 assets (already in remotePatterns) - https://accounts.google.com for OAuth - [ ] Test CSP in report-only mode first to catch violations before enforcing ## Acceptance Criteria - [ ] curl -I https://[production-url]/ shows all six headers present - [ ] No legitimate app functionality is broken by the CSP (OAuth, S3 images, Google fonts all still load) - [ ] HSTS header is only set when NODE_ENV === production

Rows
Columns

Task: Add HTTP Security Headers to next.config.js #347

Add HTTP Security Headers to next.config.js

Description

Subtasks

Acceptance Criteria