Merge origin/master

next.config.ts

@@ -45,8 +45,40 @@ const nextConfig: NextConfig = {
     // Security headers for all routes
     const securityHeaders = [
       {
+<<<<<<< HEAD
         key: 'X-DNS-Prefetch-Control',
         value: 'on',
+=======
+        source: '/:path*',
+        headers: [
+          {
+            key: 'X-DNS-Prefetch-Control',
+            value: 'on',
+          },
+          {
+            key: 'X-Frame-Options',
+            value: 'SAMEORIGIN',
+          },
+          {
+            key: 'X-Content-Type-Options',
+            value: 'nosniff',
+          },
+          {
+            key: 'Strict-Transport-Security',
+            value: 'max-age=31536000; includeSubDomains; preload',
+          },
+          {
+            key: 'Referrer-Policy',
+            value: 'strict-origin-when-cross-origin',
+          },
+          {
+            key: 'Permissions-Policy',
+            value: 'geolocation=(), microphone=(), camera=(), payment=(), usb=()',
+          },
+          // Content-Security-Policy is handled by @next-safe/middleware in src/middleware.ts
+          // Other security headers (HSTS, Referrer-Policy, Permissions-Policy) are static and configured here
+        ],
+>>>>>>> origin/master
       },
       {
         key: 'X-Frame-Options',