Add CSP and security headers

[rawritude]

Adds security headers, including a Content-Security-Policy, via Cloudflare Pages static/_headers.

Why

The site signs wallet transactions, so the highest-value hardening is preventing injected script from manipulating a transaction. script-src 'self' (no 'unsafe-inline', no external scripts) means an injected <script> — or a markup-injection bug in a dependency — cannot execute. object-src 'none', base-uri 'self' and frame-ancestors 'none' close the common bypasses and clickjacking. The other four headers are low-risk hardening.

Headers (applied to /*)

• Content-Security-Policy (below)
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Referrer-Policy: no-referrer
• Permissions-Policy disabling unused browser features

default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: https:;
connect-src 'self' https: wss:; frame-src 'self' https:; worker-src 'self' blob:;
object-src 'none'; base-uri 'self'; frame-ancestors 'none'

Validation

Built the site and served it through this exact policy locally:

• every route renders clean — no CSP violations
• the wallet-selection modal opens clean
• connecting a wallet and signing a transaction both work under the policy

The one adjustment needed was allowing data: fonts (the bundled CSS embeds them). connect-src / frame-src are kept permissive (https: / wss:) so wallet backends, WalletConnect relays and popups are unaffected — the protection comes from script-src.

If you prefer a cautious rollout, rename the header to Content-Security-Policy-Report-Only first to collect violation reports from real traffic before enforcing.