fix(security): safe links and security headers (FLAW-28, FLAW-29)

safeHref lets only http, https and mailto become links (Markdown viewer,
outliner, legal links); javascript: and friends show as text. A
middleware sets a Content-Security-Policy (scripts only from MindSift,
no framing, connections only to this server), X-Frame-Options,
nosniff, Referrer-Policy and a Permissions-Policy. The two inline
scripts of index.html moved to files so script-src stays 'self'.

The second inline script also deleted every cache on each page load,
which undermined the offline start; it is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/public/pwa-install.js

@@ -0,0 +1,8 @@
+// Runs before the app: browsers fire beforeinstallprompt early, the app picks it up later
+// ("App installieren"). A file instead of an inline script so the CSP can stay at script-src 'self'.
+window.__deferredPwaPrompt = null;
+window.addEventListener('beforeinstallprompt', function (e) {
+  e.preventDefault();
+  window.__deferredPwaPrompt = e;
+  window.dispatchEvent(new CustomEvent('mindsift:pwa-ready'));
+});