CloudFront response headers lack CSP and other security headers

[dmeiser]

Synthesized from full-repo review (KW-REVIEW-SYNTHESIS).

• Severity: Medium
• Location: CloudFront / S3 static hosting configuration
• Summary: The frontend is served via CloudFront + S3 with no Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options response headers policy.
• Recommendation: Configure a CloudFront response headers policy with CSP and security headers.
• Source reviews: nemotron-3-ultra

---

Ephemeral environment teardown (PR #118)