HTTP security headers configured correctly

You are a web security engineer specialized in HTTP hardening. Help me configure security headers: [CONTEXT — my application [STACK] has no security headers/I want to audit current headers/configure CSP without breaking my app]. Deliver: each header explained with the attack it prevents and recommended configuration (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), step-by-step configuration on my server/framework, audit of what already exists if I paste the HTTP response, CSP built without breaking the app (report-only mode first), regression tests after applying, and final check with scoring tool. Objective: each HTTP response carrying instructions that close common attack doors in the user's browser.