security(frontend): add a restrictive content security policy and dependency audit gate

[arisu6804]

Problem

Wallet-facing UI is exposed to supply-chain and injection risk when runtime script sources and dependencies are not constrained.

Objective

Deliver a production-quality improvement to production build, hosting headers, and dependency pipeline that creates measurable value for correctness, security, reliability, performance, or maintainability.

Implementation scope

• Define a restrictive CSP compatible with required wallet providers and document justified exceptions.
• Add dependency vulnerability and license checks with an actionable CI failure policy.
• Verify production headers and ensure no secret or unsafe inline execution is introduced.

Acceptance criteria

• Production responses include the intended CSP and related security headers.
• The build fails on policy-defined critical dependency findings.
• Wallet functionality still works through explicitly allowed origins.

Required validation

• Header integration tests, production smoke tests, and dependency-policy CI execution.
• Existing tests and CI remain passing.
• Add regression coverage for the original failure mode.
• Do not weaken, delete, or skip unrelated tests to obtain a green build.

PR quality bar

• Keep the PR focused on this issue and explain design tradeoffs.
• Include test evidence, compatibility impact, and migration or rollout notes where relevant.
• Avoid typo-only, documentation-only, cosmetic-only, or unrelated refactor submissions.

Out of scope

• Broad rewrites not required by the acceptance criteria.
• Changes to unrelated services, contracts, or user flows.