fix: implement @next-safe/middleware for CSP (qa-requested)

- Refactor src/middleware.ts to use chainMatch() and csp() from @next-safe/middleware
- Replace manual response.headers.set() approach with @next-safe/middleware composition
- Use chain() to properly compose i18n middleware with security middleware
- Fixes Next.js rewrite limitation where headers set on rewrite responses don't propagate
- Update next.config.ts comment to reflect correct CSP implementation

Implements QA Session 2 fix request (previously not implemented correctly).

Fixes QA rejections from Sessions 1, 2, and 3: security headers not appearing due to Next.js rewrite edge case (GitHub Issue #70515).

Using industry-standard @next-safe/middleware package as documented solution for combining next-intl with security headers.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

next.config.ts

@@ -55,6 +55,7 @@ const nextConfig: NextConfig = {
             value: 'geolocation=(), microphone=(), camera=(), payment=(), usb=()',
           },
           // Content-Security-Policy is handled by @next-safe/middleware in src/middleware.ts
+          // Other security headers (HSTS, Referrer-Policy, Permissions-Policy) are static and configured here
         ],
       },
       {