chore: add CSP/Permissions-Policy security headers and update production env vars

- Add Content-Security-Policy and Permissions-Policy headers to nginx config
- Add same headers to next.config.mjs for dev/preview mode
- Add Referrer-Policy to next.config.mjs (was only in nginx)
- Generate production JWT/CMS secrets via openssl rand -base64 64
- Update README mark production env/security header task as complete

next.config.mjs

@@ -28,6 +28,12 @@ const nextConfig = {
           { key: 'X-Content-Type-Options', value: 'nosniff' },
           { key: 'X-Frame-Options', value: 'DENY' },
           { key: 'X-XSS-Protection', value: '1; mode=block' },
+          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+          {
+            key: 'Content-Security-Policy',
+            value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://ssl.google-analytics.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.google-analytics.com https://ssl.google-analytics.com; font-src 'self'; connect-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self';",
+          },
+          { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()' },
         ],
       },
     ];