Add security headers and remove dead code

[iamspathan]

Summary

• Add security response headers via helmet middleware
• Remove unused dependencies and dead code
• Fix node_modules exposure vulnerability

Changes

• Add helmet for security headers (CSP, HSTS, X-Frame-Options, etc.)
• Remove 6 unused dependencies from agent0, 4 from todo0
• Remove dead @mcp-ui code and node_modules static serving
• Fix unused imports/variables in TypeScript files

Test plan

• Build passes
• Login/logout flow works
• Todo operations work
• Chat interface works