Harden security headers and cleanup

[dadachi]

Summary

• Remove unused rack-cors gem (not needed for native mobile app API)
• Enable Content-Security-Policy with restrictive defaults, allowing Google Fonts
• Enable Permissions-Policy to disable unnecessary browser features (camera, mic, geolocation, etc.)
• Enable DNS rebinding protection in production using RENDER_EXTERNAL_HOSTNAME and APP_HOST env vars
• Replace font preload/onload hack with standard <link rel="stylesheet"> in all layouts
• Reduce Devise token lifespan from 90 to 30 days
• Reduce max concurrent devices from 100 to 10

Test plan

• bin/rubocop — no offenses
• bin/brakeman — no security warnings
• bin/rails test — 376 tests, 709 assertions, 0 failures
• Verify font loading works correctly on web pages (password reset, error pages)
• Verify API authentication still works with reduced token lifespan/device limits
• Verify Render deployment succeeds with RENDER_EXTERNAL_HOSTNAME and APP_HOST set

🤖 Generated with Claude Code