fix(security): disable COOP header and Vite module-preload polyfill

Two console errors on HTTP deployments with no functional impact:

1. Helmet's default Cross-Origin-Opener-Policy: same-origin is ignored
   by browsers over HTTP but logged as a console error. Disabled via
   crossOriginOpenerPolicy: false (same rationale as HSTS/COEP).

2. Vite's production build injects an inline module-preload polyfill
   script blocked by script-src 'self'. Disabled via
   build.modulePreload.polyfill: false — all modern browsers support
   link rel="modulepreload" natively.

backend/src/index.ts

@@ -76,6 +76,9 @@ const getCookieOptions = (req: Request) => ({
 //   Setting null is the Helmet 8 API to remove a default directive.
 app.use(helmet({
   crossOriginEmbedderPolicy: false,
+  // COOP is only meaningful over HTTPS. Over HTTP the browser logs a warning
+  // and ignores it, creating noise in the console with no security benefit.
+  crossOriginOpenerPolicy: false,
   hsts: false,
   contentSecurityPolicy: {
     directives: {