feat(security): adopt helmet with a strict CSP

[vku2018]

Summary

• replace the manual security-header middleware with configured helmet()
• add Content-Security-Policy: default-src 'none' plus explicit Helmet-managed Cross-Origin-* headers
• preserve the existing nosniff, DENY, no-referrer, and max-age=31536000; includeSubDomains header values
• update security-header tests and README docs
• remove duplicate top-level declarations in src/index.ts that prevented Jest from importing the app

Closes #7

Validation

• PASS npm test -- src/__tests__/securityHeaders.test.ts --runInBand (32 passing assertions)
• PASS npx eslint src/__tests__/securityHeaders.test.ts --quiet
• PASS git diff --check
• FAIL npm test -- src/__tests__/securityHeaders.test.ts src/__tests__/index.test.ts --runInBand: securityHeaders.test.ts passes, but the broader existing index.test.ts suite still fails on unrelated runtime behavior such as slippage_bps is not defined, pause-state expectations, and config/bulk quote failures
• FAIL npm run build: existing TypeScript errors remain, including missing BULK_ABSOLUTE_MAX, undefined slippage_bps/min_received, PairMeta.rate, and unrelated test fixture shape issues
• FAIL npm run lint: existing repo-wide lint errors remain; the touched securityHeaders.test.ts file passes the scoped quiet lint check