fix: make nextjs prefetches aware of custom domains

[Soxasora]

Description

Prefetch requests are ignored by our middleware, making custom domains lose their domain status when clicking to links that have been prefetched.
This PR ensures that prefetch requests still go through the custom domain middleware, while still skipping referral and CSP.

Additional Context

The patch revolves around running the custom domain middleware on prefetches too, on normal stacker.news navigation prefetches are still ignored by the middleware.

Checklist

Are your changes backward compatible? Please answer below:

For example, a change is not backward compatible if you removed a GraphQL field or dropped a database column.

On a scale of 1-10 how well and how have you QA'd this change and any features it might affect? Please answer below:
7, works correctly, fixes prefetched navigation in prod. Tested in a local production environment.

For frontend changes: Tested on mobile, light and dark mode? Please answer below:
n/a

Did you introduce any new environment variables? If so, call them out explicitly here:
n/a

Did you use AI for this? If so, how much did it assist you?
local production support

---

Note

Medium Risk
Changes request handling in edge middleware for prefetch traffic and alters how CSP/security headers are applied, which could affect navigation behavior and caching for custom domains if misdetected.

Overview
Ensures Next.js prefetch requests are custom-domain aware by detecting prefetches (next-router-prefetch/purpose: prefetch) and routing them through customDomainMiddleware when a domain mapping exists.

Prefetch requests now skip referrer attribution and CSP/security headers, and the middleware matcher no longer excludes prefetches via missing header rules (prefetch handling is done in code instead).

^{Reviewed by Cursor Bugbot for commit c507723. Bugbot is set up for automated code reviews on this repo. Configure here.}

[huumn]

clean!