fix(tts): add HTTP security headers to all responses

[Olisachukwuma1]

services/tts served every response (including JSON error bodies and job data) with only Express's bare defaults. Add a first-in-chain middleware setting X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and a minimal CSP, mirroring services/api's security_headers_middleware.

Also guard app.listen() behind require.main === module so the app can be imported by tests without binding a real port, and normalize the string | string[] typing of req.params.id (Express 5) that otherwise fails compilation once server.ts is imported.

Description

Type of Change

• Bug fix
• New feature
• Refactor / code cleanup
• Documentation update
• CI / tooling change
• Breaking change

Testing Done

Bundle Size

Chunk	Before	After
vendor.js
main*.js
pages/_app*.js

Checklist

• Tests pass locally
• Documentation updated (if applicable)
• No breaking changes, or breaking changes are documented above
• If you added or changed an API endpoint, regenerated the OpenAPI spec and committed the result:

  cd services/api && cargo run --bin generate-openapi > openapi.yaml
  
  
  

closes #1219
git add openapi.yaml && git commit -m "chore: regenerate openapi.yaml"

- [ ] If you **changed system architecture** (new service, database, external dependency, or network boundary), updated [`docs/architecture.md`](../docs/architecture.md)
- [ ] Bundle size checked (if frontend changes)

## Related Issues

Closes #

[drips-wave]

@Olisachukwuma1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits