fix(csp): allow WRNexus push SDK origin in script-src and connect-src

The web-push SDK (https://api.wrnexus.com/push/sdk.js) and its runtime
config fetch were blocked by the Content-Security-Policy set in
src/middleware.ts. Added https://api.wrnexus.com to script-src (prod and
dev) and connect-src. No wildcards introduced; existing analytics
origins (GTM, GA, Plausible) unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/middleware.ts

@@ -155,11 +155,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
   // - inline scripts/styles: Required for Astro framework
   // - https://www.googletagmanager.com & https://www.google-analytics.com: GA4
   // - https://plausible.io: Plausible Analytics
+  // - https://api.wrnexus.com: WRNexus web-push SDK (sdk.js) + runtime config
   // Note: unsafe-eval is removed in production (only needed during Astro HMR dev mode)
   const isProduction = import.meta.env.PROD;
   const scriptSrc = isProduction
-    ? "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io"
-    : "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io";
+    ? "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io https://api.wrnexus.com"
+    : "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io https://api.wrnexus.com";
 
   const csp = [
     "default-src 'self'",
@@ -167,7 +168,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
     "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
     "img-src 'self' data: https://images.unsplash.com https://www.google-analytics.com https://www.googletagmanager.com https://maps.googleapis.com https://maps.gstatic.com",
     "font-src 'self' data: https://fonts.gstatic.com",
-    "connect-src 'self' https://www.google-analytics.com https://analytics.google.com https://stats.g.doubleclick.net https://plausible.io",
+    "connect-src 'self' https://www.google-analytics.com https://analytics.google.com https://stats.g.doubleclick.net https://plausible.io https://api.wrnexus.com",
     "worker-src 'self'",
     "manifest-src 'self'",
     "object-src 'none'", // Block Flash/plugins (defense-in-depth)