feat(dev-server): support headers custom HTTP response headers (#143)

[lukekania]

Closes #143.

Goal

Support angular.json's dev-server headers option so projects can configure custom HTTP response headers in dev — production-like security headers (CSP, Cross-Origin-Opener-Policy), CORS headers, cache-control overrides, etc. Previously the option was silently dropped.

Changes

• packages/builder/schemas/dev-server.json — declare headers as an object of header name to string value.
• packages/builder/src/serve/options.ts — serialize the map into a --headers '{...}' JSON arg, trimming header names and dropping empty-name / non-string entries.
• crates/cli/src/main.rs — add a --headers flag plus parse_header_overrides(), which rejects malformed JSON, non-objects, and non-string values with a clear error rather than dropping them silently.
• crates/cli/src/serve_cmd.rs — thread the parsed pairs into DevServerConfig.
• crates/dev-server/ — new CustomHeaders type:
  • validates each header once at startup; invalid entries are dropped with a warn instead of failing every request;
  • applied to every served response — static assets, the SPA-fallback index.html, and the SSE live-reload stream;
  • never overrides headers the server sets itself: Content-Type and Cache-Control on files, plus Connection / Access-Control-Allow-Origin on SSE.

Headers are applied only in the Rust dev server, so proxy-forwarded responses keep their upstream headers untouched — no change needed in the Node proxy, which is transparent.

Definition of done

• "headers": { "Cross-Origin-Opener-Policy": "same-origin" } results in the dev server emitting that header on every HTML/JS/asset response — covered by integration tests.
• Headers do not leak into proxy-forwarded responses (they never run in the proxy path).

Note on Cache-Control

The issue lists "cache-control overrides" as a motivating use case, but its Scope section says not to override headers the server sets itself. Live reload depends on Cache-Control: no-cache, so a user Cache-Control entry is skipped (documented in code and the schema). Happy to revisit if overriding it is desired.

Tests

• dev-server: 8 new integration cases (static / index / SPA / SSE emission, Content-Type and Cache-Control not clobbered, multi-header, no-headers) + 6 new CustomHeaders unit tests.
• CLI: 5 new parse_header_overrides cases.
• builder: 4 new translateOptions vitest cases.
• cargo clippy, tsc --noEmit clean; version bumped 0.10.14 → 0.10.15.