Add security headers to MABP dashboard and API

[tjamescouch]

Summary

• mabp-dashboard/server.js: Add security headers (HSTS, X-Frame-Options DENY, X-Content-Type-Options nosniff, CSP, Referrer-Policy, X-XSS-Protection 0) to all responses. Reject non-GET/HEAD methods with 405.
• mabp-api/index.js: Disable X-Powered-By, add security headers middleware, limit JSON body parsing to 64kb.

Test plan

• Verify dashboard serves index.html with all security headers
• Verify POST/PUT/DELETE to dashboard returns 405
• Verify API responses include security headers
• Verify API rejects JSON bodies > 64kb

🤖 Generated with Claude Code