fix: add Helmet middleware for HTTP security headers (closes #17)

[LucasMaupin]

Summary

• Imported @fastify/helmet (already present in dependencies) into src/server.ts
• Registered the Helmet plugin before CORS so security headers are applied to every response
• Configured contentSecurityPolicy with defaultSrc: 'none' and connectSrc: 'self' (appropriate for a pure API server)
• Set crossOriginResourcePolicy: cross-origin to stay consistent with the existing CORS origin: '*' setting

This adds X-Frame-Options, X-Content-Type-Options: nosniff, Strict-Transport-Security, Referrer-Policy, and Content-Security-Policy headers to all responses, closing the OWASP A05 finding.

Closes #17