- Add Content-Security-Policy and Permissions-Policy headers to nginx config
- Add same headers to next.config.mjs for dev/preview mode
- Add Referrer-Policy to next.config.mjs (was only in nginx)
- Generate production JWT/CMS secrets via openssl rand -base64 64
- Update README mark production env/security header task as complete