feat(module10): add local security headers server

[senih25]

Purpose

Implements Module 10-E local security remediation by serving the static demo with explicit security headers.

Scope

• Adds experiments/module-10-security-demo/server.py
• Moves inline data: stylesheet into styles.css so CSP can use style-src 'self'
• Updates README with the security-header server command

Security Headers

• Content-Security-Policy
• X-Frame-Options: DENY
• X-Content-Type-Options: nosniff
• Referrer-Policy: no-referrer-when-downgrade
• Permissions-Policy
• Strict-Transport-Security

Validation

• python -m py_compile experiments/module-10-security-demo/server.py
• Local HTTP smoke test on port 8097 returned 200
• styles.css returned 200 text/css
• app.js returned 200 application/javascript
• All expected remediation headers were present in the document response

Safety

• Local-only
• No deploy
• No cloud resource
• No external API
• No secrets
• No .env
• No PHI / e-Nabiz / TCKN
• No production security testing