Security hardening: escape names in result screens, drop tech-stack headers

- Escape player names rendered via innerHTML on the hand-over and game-over
  score rows (defense-in-depth XSS; names are already capped at 16 chars)
- app.disable('x-powered-by') to stop advertising Express
- Add safe response headers: X-Content-Type-Options, X-Frame-Options,
  Referrer-Policy (no CSP — inline SW script + socket.io would need unsafe-inline)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server.js

@@ -10,6 +10,17 @@ const bcrypt     = require('bcryptjs');
 const jwt        = require('jsonwebtoken');
 
 const app        = express();
+app.disable('x-powered-by'); // don't advertise the tech stack
+
+// Safe security headers (no CSP here — inline SW script + socket.io would need
+// 'unsafe-inline'/wss exceptions; Cloudflare already terminates TLS/HSTS)
+app.use((_req, res, next) => {
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'DENY');
+  res.setHeader('Referrer-Policy', 'no-referrer');
+  next();
+});
+
 const httpServer = http.createServer(app);
 
 let httpsServer = null;