[Frontend] Add Content Security Policy compatible with Stellar and PWA features

## Problem

The application lacks a documented CSP despite handling wallets, tokens, uploads, maps, and service workers.

## Relevant code

`next.config.ts, src/pages/_document.tsx`

## Proposed scope

Define a least-privilege policy without unsafe wildcards, document required origins, and add response-header tests.

## Acceptance criteria

- [ ] The reported behavior is reproduced or characterized with a focused automated test before the fix.
- [ ] The implementation satisfies the proposed scope without weakening TypeScript, lint, authorization, privacy, or error handling.
- [ ] Success, empty/loading where applicable, failure, and boundary cases are covered.
- [ ] Existing related tests pass and new regression coverage is included.
- [ ] User-facing behavior remains accessible by keyboard and at mobile viewport sizes where UI is affected.
- [ ] Documentation is updated when the change alters configuration, contracts, security assumptions, or contributor workflow.

## Contributor notes

Base the work on the latest `main` branch. Keep unrelated refactors out of the pull request and include screenshots or recordings for visible changes. Never use real pet, medical, contact, wallet, or credential data in fixtures.

Review next.config.ts and src/pages/_document.tsx first, then identify the wallet, token, upload, map, service-worker, Stellar, and PWA origins that require access. Add focused automated response-header tests covering the policy and its relevant boundary cases, and update documentation for the required origins and security assumptions. Done means the least-privilege CSP is documented, tested, and does not weaken the stated constraints.

Written by the indexing model from the issue text.