CSP_ENFORCE defaults to false; decide and document production default

[nanaf6203-bit]

Context

src/middleware.ts only applies the full nonce-based CSP when CSP_ENFORCE=true; the variable defaults off, while next.config.ts still sets a static CSP header unconditionally.

Problem

Production posture is ambiguous: teams may believe nonce CSP is active when enforcement is off, or the static header may mask gaps in testing.

Proposed approach

Decide the default (recommend: enforce in production, warn in dev), set it in .env.example/schema with a secure default, and document how to verify (curl -I nonce header) in docs/security-headers.md.

Acceptance criteria

• Default value decided and documented
• Schema validates CSP_ENFORCE boolean
• Docs include verification steps