fix: API Reference page (/docs) blank — CSP blocked the Scalar bundle

script-src had no allowance for cdn.jsdelivr.net, which is where the
Scalar API-reference viewer's JS is loaded from — the script itself
never ran. Added it to script-src/style-src/font-src/connect-src.

(User-confirmed before applying — widens what's allowed to load, so
wanted explicit sign-off rather than just doing it in response to a
console error.)

apps/web/next.config.ts

@@ -33,11 +33,11 @@ const securityHeaders = [
     key: "Content-Security-Policy",
     value: [
       "default-src 'self'",
-      "script-src 'self' 'unsafe-inline' 'unsafe-eval'", // unsafe-eval needed by Next.js dev; tighten in prod
-      "style-src 'self' 'unsafe-inline'",
+      "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net", // unsafe-eval needed by Next.js dev; tighten in prod. jsdelivr serves the Scalar API-reference bundle on /docs.
+      "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net",
       `img-src 'self' data: blob: ${storageOrigin} https://www.gravatar.com`,
-      "font-src 'self'",
-      `connect-src 'self' ${storageOrigin}`,
+      "font-src 'self' https://cdn.jsdelivr.net data:",
+      `connect-src 'self' ${storageOrigin} https://cdn.jsdelivr.net`,
       "frame-ancestors 'none'",
       "base-uri 'self'",
       "form-action 'self'",