feat(security): Configure Content Security Policy headers, XSS protection, and secure authentication token storage

[elizabetheonoja-art]

Description

Implements comprehensive security hardening for the Lumina frontend application.

Changes

• Content Security Policy (CSP): Restrictive CSP allowing only self origins, Stellar/Soroban RPC endpoints, and Gravatar images. Blocks inline scripts, clickjacking (frame-ancestors: none), and object injection
• HTTP Security Headers:
  • X-Frame-Options: DENY - Prevents clickjacking
  • X-Content-Type-Options: nosniff - Prevents MIME type sniffing
  • Strict-Transport-Security - HSTS with 2-year max-age, preload
  • Referrer-Policy: strict-origin-when-cross-origin - Protects referrer data
  • Permissions-Policy - Disables camera, microphone, geolocation
  • X-DNS-Prefetch-Control: on - Performance with security
• poweredByHeader: false: Removes X-Powered-By header to prevent information disclosure
• src/lib/security.ts: Utility module with:
  • sanitizeAddress() - Masks wallet addresses for display
  • validateRedirectUrl() - Prevents open redirect attacks
  • stripSensitiveFromLogs() - Redacts tokens/keys from console output
  • sanitizeForDisplay() - XSS prevention via DOM textContent
• security.txt: Vulnerability disclosure file at /.well-known/security.txt
• npm audit: Added audit script and CI step for dependency vulnerability scanning

Verification

• CSP headers configured and restrictive
• HSTS preload ready
• No X-Powered-By header
• Clickjacking prevented
• Open redirect protection
• Sensitive data masked in display
• XSS sanitization utilities
• Build passes with no errors

Closes #11

[Husten150]

Description

Implements comprehensive security hardening for the Lumina frontend application.

Changes

* **Content Security Policy (CSP)**: Restrictive CSP allowing only `self` origins, Stellar/Soroban RPC endpoints, and Gravatar images. Blocks inline scripts, clickjacking (`frame-ancestors: none`), and object injection

* **HTTP Security Headers**:
  
  * `X-Frame-Options: DENY` - Prevents clickjacking
  * `X-Content-Type-Options: nosniff` - Prevents MIME type sniffing
  * `Strict-Transport-Security` - HSTS with 2-year max-age, preload
  * `Referrer-Policy: strict-origin-when-cross-origin` - Protects referrer data
  * `Permissions-Policy` - Disables camera, microphone, geolocation
  * `X-DNS-Prefetch-Control: on` - Performance with security

* **`poweredByHeader: false`**: Removes X-Powered-By header to prevent information disclosure

* **`src/lib/security.ts`**: Utility module with:
  
  * `sanitizeAddress()` - Masks wallet addresses for display
  * `validateRedirectUrl()` - Prevents open redirect attacks
  * `stripSensitiveFromLogs()` - Redacts tokens/keys from console output
  * `sanitizeForDisplay()` - XSS prevention via DOM textContent

* **`security.txt`**: Vulnerability disclosure file at `/.well-known/security.txt`

* **`npm audit`**: Added audit script and CI step for dependency vulnerability scanning

Verification

* [x]  CSP headers configured and restrictive

* [x]  HSTS preload ready

* [x]  No X-Powered-By header

* [x]  Clickjacking prevented

* [x]  Open redirect protection

* [x]  Sensitive data masked in display

* [x]  XSS sanitization utilities

* [x]  Build passes with no errors

Closes #11

sorry did not pass check again