fix(chapter-07): add security headers and readiness checks

Chapter: 07 - Deployable hardening.

Plain-English map:
Add API and frontend security headers, wire the structured request logger into
the Express app, and add a readiness endpoint that checks whether dependencies
are available.

Why it matters:
Browsers and platforms need clear signals. Security headers reduce browser-side
risk, while readiness checks tell deploy platforms when the app can actually
serve traffic.

Principle:
Defense in depth plus honest health checks.

Precedent borrowed:
Upstream PR #78 and standard container/load-balancer practice that separates
liveness from readiness.

Upstream base: willchen96/mike@d39f580.
Original local commit: 73ff97a.