…eaders (#11, #12, #13)

#11 — No HTTP server timeouts (slowloris)
The main HTTP server used router.Run() which constructs an http.Server
with no Read/Write/Idle timeouts. A slow client could hold a connection
open indefinitely sending headers one byte at a time.

Fix: build *http.Server explicitly with:
- ReadHeaderTimeout: 10s (the slowloris defence — bounds time to receive
  request headers)
- ReadTimeout: 30s
- WriteTimeout: 60s
- IdleTimeout: 120s
- MaxHeaderBytes: 1 MB
The metrics server gets the same hardening.

#12 — No graceful shutdown for the main HTTP server
The metrics server already had a Shutdown call wired to context cancellation
but the main HTTP server was killed mid-flight when the process received a
signal, dropping in-progress responses.

Fix: shut down BOTH servers with srv.Shutdown(ctx) on context cancellation,
with a 30-second drain timeout.

#13 — Missing security headers
SecurityHeadersMiddleware only set X-Content-Type-Options, X-Frame-Options,
Referrer-Policy, and X-XSS-Protection. Missing HSTS, CSP, Permissions-Policy.
Token responses had no Cache-Control.

Fix:
- Permissions-Policy disabling geolocation/microphone/camera/payment/usb
- Strict-Transport-Security gated behind a new --enable-hsts flag (default
  off — operators not behind TLS would lock browsers out for a year)
- Content-Security-Policy on by default with a conservative starting policy
  (frame-ancestors 'none' replaces X-Frame-Options as the modern equivalent)
  and a --disable-csp escape hatch for dashboards we haven't tightened yet
- /oauth/token responses now set Cache-Control: no-store, no-cache,
  must-revalidate, private (RFC 6749 §5.1) and Pragma: no-cache