Security Headers in Next.js: The Config I Actually Ship

The complete security headers configuration for Next.js — CSP, HSTS, X-Frame-Options, and the nonce-based approach for inline scripts.