security: add X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers

[xpoes123]

No security response headers were set on any route. This adds a small middleware in app.js that applies three baseline headers to every response.

Problem

Without X-Content-Type-Options, browsers may MIME-sniff response bodies and execute content as a different type than declared. Without X-Frame-Options, any external site can embed qbreader pages in an iframe (clickjacking). Without Referrer-Policy, the full URL — including any query parameters — leaks to third-party origins via the Referer header.

Changes

• Adds an inline middleware before routing that sets:
  • X-Content-Type-Options: nosniff
  • X-Frame-Options: SAMEORIGIN
  • Referrer-Policy: strict-origin-when-cross-origin

Risk & testing

Configuration-only, no logic changes. CSP is intentionally omitted to avoid breaking existing inline scripts and styles; HSTS is omitted since HTTPS is already enforced by the existing httpsEnforcement middleware. No new dependencies. semistandard and node --check pass.