feat: CSP/security headers plugin and critical dependency audit gate

[Arome8240]

Summary

Adds a restrictive Content-Security-Policy and a full set of companion security headers, delivered as a zero-dependency Vite plugin. Also gates the CI pipeline on npm audit --audit-level=critical so supply-chain vulnerabilities block builds before tests run.

Changes

vite-plugin-security-headers.js — new Vite plugin

• Injects 8 security headers via dev and preview server middleware
• Exports buildCsp() and SECURITY_HEADERS for test assertions and deploy-config generators (nginx, Cloudflare Workers, etc.)
• CSP directives: default-src 'self', script-src 'self', connect-src 'self' https://horizon-testnet.stellar.org https://horizon.stellar.org, object-src 'none', frame-ancestors 'none', base-uri 'self', form-action 'self', upgrade-insecure-requests

vite.config.js — registers the plugin

.github/workflows/ci.yml — adds npm audit --audit-level=critical before the test step

package.json — adds audit script; extends test script to include test/security

test/security/csp-headers.test.js — 25 unit tests covering every CSP directive, companion headers, and a regression guard for the original failure mode (no CSP present)

test/security/dependency-audit.test.js — 8 tests verifying the audit step and plugin registration are wired up in CI and vite.config

Design tradeoffs

Decision	Rationale
style-src 'unsafe-inline' retained	Vite injects an inline <style> tag at build time; removing it breaks rendering. Script execution is unaffected.
Freighter / Albedo — no CSP exemption	Both wallet extensions communicate via window.postMessage (browser-extension bridge), not fetch/XHR, so no connect-src or script-src entry is needed.
Both Horizon origins in connect-src	Covers VITE_STELLAR_NETWORK=testnet and =public without requiring a build-time branch.
Vite plugin (not meta tag)	HTTP headers are enforceable by the browser regardless of DOM manipulation; meta-tag CSP does not support frame-ancestors or sandbox.
--audit-level=critical only	High/moderate findings are often false positives in frontend-only packages; critical findings indicate actively exploitable vulnerabilities and are an unambiguous block signal.

Test evidence

• 33 new security tests — all passing
• 128 pre-existing tests — all passing, none modified
• npm run build — clean with no errors

fixes #285