fix(housekeeping): address task 14 review round 1

src/app/api/media/[...path]/route.ts

@@ -47,6 +47,13 @@ export async function GET(
 		headers: {
 			// eslint-disable-next-line security/detect-object-injection -- ext validated against ALLOWED_EXT
 			"Content-Type": mime[ext] ?? "application/octet-stream",
+			"X-Content-Type-Options": "nosniff",
+			...(ext === ".svg"
+				? {
+						"Content-Security-Policy":
+							"sandbox; default-src 'none'; style-src 'unsafe-inline'",
+					}
+				: {}),
 			"Cache-Control": "public, max-age=3600, must-revalidate",
 		},
 	});