fix(server): keep debug-log timestamps server-owned and send nosniff

The voice debug log writes the server's timestamp after the client's record,
so a record can no longer replace loggedAt. The dev and preview servers also
send X-Content-Type-Options: nosniff with their shared browser headers.

From the findings in #710.

Co-authored-by: Sunil <[email protected]>
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

build/vite.js

@@ -36,6 +36,8 @@ export const BROWSER_CSP = [
 export const BROWSER_HEADERS = Object.freeze({
   'X-Frame-Options': 'DENY',
   'Content-Security-Policy': BROWSER_CSP,
+  // Responses are only ever used as the type the server declares.
+  'X-Content-Type-Options': 'nosniff',
 });
 
 /** Build browser assets with explicit inputs; never load environment or providers. */