The security floor is missing its two isolation headers: COOP and CORP on every response #232

Pushed successfully.

Added cross-origin-opener-policy: same-origin and cross-origin-resource-policy: same-origin to SECURITY in src/server.ts, so every response inherits them along with the rest of the floor.

• src/server.test.ts: a new table-driven test hits nine response kinds (page, bundle, leaderboard, a successful match post, 403, 404, 413, 429, and 500) and asserts both headers on each. The 500 case is a real crash, not a stub: an empty Host header leaves new URL(request.url) nothing to parse, and the error() handler catches it — confirmed this genuinely reaches Bun's error callback (a direct server.fetch() call bypasses it, so the test goes over the real network).
• README.md: the src/server.ts bullet now lists every header the floor carries.
• Verified by hand against a running instance that CSP, WebGL2-relevant behavior, and the rest are untouched — cross-origin-embedder-policy was deliberately left out since the app loads nothing cross-origin.

bun run check (types + all 837 tests) passes. Nothing else changed.

Closes #192