feat(security): emit COOP, CORP, and X-Permitted-Cross-Domain-Policies headers

Three additions to the production header set in `src/proxy.ts`:

- `Cross-Origin-Opener-Policy: same-origin` isolates the
  BrowsingContextGroup from cross-origin popups. Closes the
  `window.opener` reference channel for Spectre-class side-channel
  attacks. The OAuth flows (Withings, Codex) are top-level redirects
  rather than popups, so they aren't affected.
- `Cross-Origin-Resource-Policy: same-origin` narrows the page's
  resources to same-origin loaders, complementing the existing
  `frame-ancestors 'none'` CSP rule for non-document subresources.
- `X-Permitted-Cross-Domain-Policies: none` shuts the Flash / Adobe
  Reader `crossdomain.xml` channel that some scanners still flag.

All three land in every response; production-only HSTS stays in its
existing `!isDev` block. No CSP changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/proxy.ts

@@ -233,6 +233,16 @@ export function proxy(request: NextRequest) {
     "Permissions-Policy",
     "camera=(), microphone=(), geolocation=()",
   );
+  // COOP isolates this BrowsingContextGroup from cross-origin popups,
+  // closing the Spectre-class side-channel surface a stray
+  // `window.opener` reference would otherwise carry. CORP narrows the
+  // page's resources to same-origin loaders, complementing the
+  // `frame-ancestors 'none'` CSP rule for non-document subresources.
+  // The legacy `X-Permitted-Cross-Domain-Policies` line shuts the
+  // Flash/PDF crossdomain.xml channel that some scanners still flag.
+  response.headers.set("Cross-Origin-Opener-Policy", "same-origin");
+  response.headers.set("Cross-Origin-Resource-Policy", "same-origin");
+  response.headers.set("X-Permitted-Cross-Domain-Policies", "none");
 
   // CSP — permissive in dev, strict in production. Third-party hosts in
   // `connect-src` are gated to the surfaces that actually need them so a