fix: eliminate duplicate security headers across nginx/Kong/backend

Summary

• Make nginx the single authoritative source for all client-facing security headers and CORS, eliminating duplicates across the 3-layer proxy chain (nginx → Kong → backend)
• Rename security-headers.conf → security-headers.inc to prevent nginx auto-including it at the http level (fixes ERR_INVALID_CHUNKED_ENCODING reported by another developer)
• Disable redundant Kong CORS and response-transformer plugins
• Replace backend securityHeaders.js with no-op (upstream headers stripped by nginx)

Test plan

• curl -skD - https://localhost/ | grep -c "X-Content-Type-Options" returns 1 (was 2)
• curl -skD - https://localhost/api/health | grep -c "Access-Control-Allow-Origin" returns 1 (was duplicated Kong + nginx)
• curl -skD - https://localhost/api/health | grep -i "X-Powered-By: Kong" returns 0
• nginx config validation passes (nginx -t)
• Browser loads https://localhost without ERR_INVALID_CHUNKED_ENCODING (not reproducible locally, confirmed no duplicate headers)
• Keycloak login flow still works (/auth/ → 302 → /auth/admin/, X-Frame-Options: SAMEORIGIN)
• API calls from frontend still work (/api/health → 200, /api-docs → 301, protected endpoints → 401)
• CORS preflight returns 204 with single set of headers

Closes #611 (closed)