fix(security): set Referrer-Policy on board responses

[benvinegar]

Summary

• set Referrer-Policy: no-referrer before authentication for every app response
• prevent query-key bootstrap URLs from leaking the deploy token through outbound Referer headers
• cover public, denied, authenticated, and Worker-rendered responses

Fixes #147

Validation

• npm test
• npm run coverage
• npm run test:worker
• npm run typecheck
• npm run lint
• npm run format:check
• npm run security:audit

This PR description was generated by Pi using GPT-5.6 Terra