feat: send security headers on every response

Nothing set a CSP, a referrer policy, nosniff or a framing rule, so the
app relied entirely on the same-origin policy.

The referrer policy is the one with a concrete leak behind it: a share
token is part of the URL path, so following any outbound link from a
shared entry handed a third party a working link to a private entry.
`no-referrer` closes that.

The layer is `if_not_present`, so the media routes keep the stricter
sandbox CSP they set for themselves.

Cargo.toml

@@ -9,7 +9,7 @@ axum = { version = "0.8", features = ["multipart", "macros"] }
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "fs"] }
 tower = "0.5"
 tokio-util = { version = "0.7", features = ["io"] }
-tower-http = { version = "0.6", features = ["trace", "compression-gzip", "limit"] }
+tower-http = { version = "0.6", features = ["trace", "compression-gzip", "limit", "set-header"] }
 sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "migrate", "macros"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"