[Browser][Security] Deploy strict CSP, Trusted Types, and wallet intent protection

[0takuc0mrade]

Summary

Closes #74.

This establishes a strict browser security baseline for EduVault without adding runtime dependencies:

• generates a cryptographically random CSP nonce per response and forwards it through Next.js rendering
• removes production unsafe-eval and inline-script fallbacks, enables Trusted Types, and allowlists script, connection, frame, form, image, and media targets
• applies HSTS, clickjacking, MIME-sniffing, referrer, permissions, COOP, COEP, and CORP policies
• centralizes server-side normalization for metadata, HTTPS URLs, remote images, SVG, redirects, and download filenames
• verifies human-readable Stellar network, account, operation, recipient/contract, asset, and amount intent before opening a wallet signing prompt
• adds a bounded, sampled, privacy-safe, and deduplicated CSP reporting endpoint
• documents the cookie and browser-isolation baseline and adds enforcement-mode browser coverage to frontend CI

Why

EduVault renders creator-controlled metadata while wallet and session authorization are available in the same browser context. The previous static CSP allowed inline scripts and unsafe-eval, allowed broad remote targets, and did not bind wallet prompts to independently verified transaction intent. An injected payload or modified XDR could therefore operate with too much browser trust.

Impact

Next.js pages are rendered dynamically so each response can receive a unique nonce. Existing React style attributes remain supported, wallet popups remain compatible through same-origin-allow-popups, and remote media is restricted to the configured IPFS/avatar gateways. Transactions without a complete matching intent now fail before invoking the wallet.

Existing session cookies were already HttpOnly, SameSite=Strict, path/lifetime scoped, secure in production, and refresh-token rotation was already present, so this PR documents that behavior instead of refactoring the auth routes.

Validation

• npm run build
• npm test -- --run — 118 tests passed
• focused ESLint over every changed JS/JSX file
• focused backend security, proxy, import, and delivery regression tests
• node --test tests/browser/security.test.mjs using production Next.js and headless Chrome
• npm run scan:secrets
• npm run audit:deps at the repository's critical threshold
• git diff --check

Existing repository checks

The repository-wide lint command still encounters pre-existing parse errors in the backup scripts. The full raw Node backend runner also retains pre-existing module-resolution/dependency failures involving the @/lib alias and undeclared dotenv; all touched backend suites pass directly.

[barry01-hash]

Nice contribution