Deny framing on all responses to prevent clickjacking

[Fyko]

What

Adds a global middleware that sets Content-Security-Policy: frame-ancestors 'none' and X-Frame-Options: DENY on every response.

Why

The viewer shell renders the sharing controls (make public/private, manage access). Right now nothing stops another origin from embedding the shell in an iframe, so a malicious page could clickjack those controls — overlay an invisible shell over bait UI and trick a logged-in user into flipping a doc public.

There were no anti-framing headers anywhere in the worker.

Why it's safe as a blanket header

The only iframe the app renders is the document itself, via iframe.srcdoc. srcdoc content isn't fetched by URL, so frame-ancestors never applies to it — legit document rendering is unaffected. Nothing else in the app frames its own pages by URL.

Test

Added an assertion to the health route test that both headers are present on a response. 48 passed locally, typecheck clean.