fix(security): disable COOP header and Vite module-preload polyfill

Two console errors on HTTP deployments with no functional impact:

1. Helmet's default Cross-Origin-Opener-Policy: same-origin is ignored
   by browsers over HTTP but logged as a console error. Disabled via
   crossOriginOpenerPolicy: false (same rationale as HSTS/COEP).

2. Vite's production build injects an inline module-preload polyfill
   script blocked by script-src 'self'. Disabled via
   build.modulePreload.polyfill: false — all modern browsers support
   link rel="modulepreload" natively.

frontend/vite.config.ts

@@ -11,6 +11,13 @@ export default defineConfig({
       "@": path.resolve(__dirname, "./src"),
     },
   },
+  build: {
+    // Disable the module-preload polyfill inline script.
+    // Vite injects a small inline <script> for module preloading that violates
+    // our CSP (script-src 'self' blocks all inline scripts). All modern browsers
+    // support <link rel="modulepreload"> natively, so the polyfill is unnecessary.
+    modulePreload: { polyfill: false },
+  },
   server: {
     proxy: {
       '/api': {