fix(csp): add frame-src, delete unreachable IPFSDocViewer, use per-request nonce for theme script

[ZacLou]

Closes #305

This PR resolves the incomplete CSP policy and removes the unreachable component it blocked.

Changes

• security-headers.js now accepts an optional nonce; when provided, script-src uses nonce-<value> instead of unsafe-inline.
• Added frame-src 'none' to the CSP (the IPFSDocViewer iframe has been removed).
• Added middleware.ts that generates a per-request CSP nonce and exposes it via the x-nonce response header.
• Updated src/app/layout.tsx to read the nonce from headers() and apply it to the anti-flicker theme script.
• Deleted the unreachable IPFSDocViewer component, its helpers, and tests.
• Replaced an innerHTML clear in Leaderboard.tsx with replaceChildren().
• Extended __tests__/security-headers.test.js to assert frame-src is present and that a supplied nonce removes unsafe-inline from script-src.

Verification

• npx tsc --noEmit passes
• ESLint passes
• Unit tests pass