Sweep: delete dead .ic-assets.json5, port security headers to _headers, add _redirects for SPAs

[marc0olo]

Part of #1458.

The switch to @dfinity/static-site (#1449) left all frontend config on the legacy mechanism. Certified-assets ignores .ic-assets.json5 entirely and ships no default security headers; configuration now lives in _headers / _redirects files (see the migration mapping in icskills#256, references/migrating-from-asset-canister.md).

Current state: 18 .ic-assets.json5 files remain (hosting/oisy-signer-demo, motoko/ic-pos, rust/{image-classification, photo_gallery, qrcode}, and all 14 motoko+rust vetkeys frontends). They sit in public//assets/, so they are uploaded and publicly served as dead assets. No _headers or _redirects file exists anywhere in the repo.

Sweep, per example:

1. Delete .ic-assets.json5.
2. Port real header config to _headers: explicit CSPs exist in oisy-signer-demo (hardened), image-classification, photo_gallery, qrcode, vetkeys password_manager(+_with_metadata) ×2; X-Frame-Options: DENY in basic_vetkd ×2. Files with only security_policy: "standard"/"hardened" presets need the headers written out explicitly — there is no preset equivalent.
3. Add _redirects (/* /index.html 200) where the frontend uses client-side routing with deep links (check ic-pos and the vetkeys apps); verify deep-link refresh doesn't 404.
4. Fix hosting/static-website/README.md, whose embedded icp.yaml snippet still shows @dfinity/asset-canister@v2.1.0 while the actual file uses static-site.
5. Afterwards, document the _headers/_redirects convention in AGENTS.md so new examples follow it.

Note _headers patterns match the asset key (/*.html, /assets/*), single-* syntax only — no ** globs.