Chore: add deploy configuration for static hosting

[SandObserver]

Summary
Adds public/_headers with security and cache headers for the built site, and
.node-version pinning 22.12.0 so a host resolves the toolchain the build
expects.

Headers set: X-Content-Type-Options, Referrer-Policy, X-Frame-Options: SAMEORIGIN, a restrictive Permissions-Policy, and HSTS. Long immutable cache
for /img/* and /icons/*.

SAMEORIGIN rather than DENY, because the widget previews are same-origin
iframes and DENY blocks those too.

Testing
npm run build and npm run check both pass. The production build was served
with these headers applied and loaded in Chrome: all five widget iframes render
on the landing page and the Now Playing page, and the console is clean.

Checklist

• npm run build and npm run check both pass.
• Product UI is shown by running or capturing it, never recreated in CSS.
• Any new preview or screenshot carries no private hostnames or real data.
• Visual changes verified in both colour schemes and both docs themes.
• Links to the app repo still resolve.