fix(seo): add baseline security headers; unify brand name to singular

- src/middleware.ts now sets HSTS, X-Content-Type-Options, X-Frame-Options,
  Referrer-Policy, and Permissions-Policy on every response -- all were
  absent per the 2026-09-15 audit. CSP deliberately left out: the site
  uses unnoned inline scripts, inline style attributes throughout, and a
  runtime-configured analytics script host, so a real CSP needs its own
  pass with live testing rather than a guess.
- SiteHeader.astro and SiteFooter.astro logo alt/aria-label said 'MNQ
  Catering y Eventos' (plural) while every title tag, the JSON-LD name,
  og:site_name, and package.json all say 'MNQ Catering y Evento'
  (singular) -- unified to the singular form used everywhere else.

src/components/SiteFooter.astro

@@ -7,10 +7,10 @@ const whatsappAriaLabel = 'Contactar con MNQ por WhatsApp';
     <div class="footer-inner">
 
       <div class="footer-brand">
-        <a href="/" aria-label="MNQ Catering y Eventos">
+        <a href="/" aria-label="MNQ Catering y Evento">
           <img
             src="/images/logo-secondary.webp"
-            alt="MNQ Catering y Eventos"
+            alt="MNQ Catering y Evento"
             width="224"
             height="224"
             style="height: 3.5rem; width: auto; mix-blend-mode: multiply; margin-bottom: 1rem;"