[jdotc1]

Summary

• Add X-Content-Type-Options: nosniff and a restrictive Permissions-Policy to frontend responses.
• Permit Strict-Transport-Security: max-age=31536000 only for production builds explicitly configured with PRISM_ENABLE_HSTS=true; it stays off by default to avoid applying HSTS to HTTP deployments.
• Document the build-time opt-in and HTTPS prerequisite in the README.

Closes #230.

Checks

• Node config checks: verified base headers in development/production, and HSTS only with both production mode and explicit opt-in.
• git diff --check
• Full frontend typecheck/lint/tests/build (dependencies not installed here)

Notes

No changes to indexer, contracts, or Docker. HSTS deliberately omits includeSubDomains and preload to avoid impacting unrelated hosts.

[vercel]

@jdotc1 is attempting to deploy a commit to the thewealthyplace100-8633's projects Team on Vercel.

A member of the Team first needs to authorize it.