[Security][LOW] Missing HTTP security headers in Harper responses

## Summary

Several defensive HTTP security headers are absent from Harper's HTTP responses by default.

## Missing headers

| Header | Risk of absence |
|---|---|
| `Strict-Transport-Security` | No HSTS; browsers do not pin to HTTPS, enabling SSL-stripping on first visit |
| `X-Content-Type-Options: nosniff` | Allows MIME-type sniffing; can facilitate polyglot attacks in edge cases |
| `Referrer-Policy` | Full `Referer` header leaked to third-party origins |
| `Permissions-Policy` | Browser features unrestricted where Harper serves HTML content |

## Recommendation

Add the following headers to all HTTP responses:

```
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
```

`Permissions-Policy` is most relevant where Harper serves HTML (e.g. the admin interface) and should be scoped to the minimum set of features required.

Ideally expose these as configurable in `harperdb-config.yaml` (e.g. `http.securityHeaders`) so operators can adjust or opt out for environments where the defaults don't fit.

## Severity

**Low** — no direct exploit path in isolation, but missing HSTS enables SSL-stripping on first visit and `X-Content-Type-Options` is a low-cost hardening win.