Fix SEC-10: add Permissions-Policy header

- Add Permissions-Policy header disabling camera, microphone,
  geolocation, and payment browser features
- Update assertSecurityHeaders test helper to verify the new header

Security: Permissions-Policy restricts browser APIs that this
application does not use, reducing attack surface from content
injection vulnerabilities. No crypto or auth flow changes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/ui/ui_test.go

@@ -79,6 +79,7 @@ func assertSecurityHeaders(t *testing.T, h http.Header, label string) {
 		{"X-Frame-Options", "DENY"},
 		{"Strict-Transport-Security", "max-age="},
 		{"Referrer-Policy", "no-referrer"},
+		{"Permissions-Policy", "camera=()"},
 	}
 	for _, c := range checks {
 		val := h.Get(c.header)