fix(web): deprecate app.supermemory.ai / and /login, add clickjacking headers

Redirect the old app entry points (/ , /login, /login/*) to the console
and send CSP frame-ancestors 'none' + X-Frame-Options: DENY on every
response so any remaining HTML surface cannot be framed, matching console.

Co-authored-by: Dhravya Shah <dhravya@supermemory.com>

apps/web/next.config.ts

@@ -37,8 +37,41 @@ const nextConfig: NextConfig = {
 		]
 	},
 	skipTrailingSlashRedirect: true,
+	async headers() {
+		// app.supermemory.ai is being deprecated in favour of the console.
+		// Anything that still serves HTML must not be framable, matching the
+		// console's clickjacking protection.
+		return [
+			{
+				source: "/:path*",
+				headers: [
+					{ key: "X-Frame-Options", value: "DENY" },
+					{
+						key: "Content-Security-Policy",
+						value: "frame-ancestors 'none'",
+					},
+				],
+			},
+		]
+	},
 	async redirects() {
 		return [
+			// The old app surface is dying: send its entry points to the console.
+			{
+				source: "/",
+				destination: "https://console.supermemory.ai",
+				permanent: false,
+			},
+			{
+				source: "/login",
+				destination: "https://console.supermemory.ai",
+				permanent: false,
+			},
+			{
+				source: "/login/:path*",
+				destination: "https://console.supermemory.ai",
+				permanent: false,
+			},
 			{
 				source: "/new",
 				destination: "/",