fix: constrain PWA caching and extend font CSP

packages/styles/src/config.ts

@@ -514,7 +514,8 @@ export async function loadAppConfig(appRoot: string, profile?: string): Promise<
 
 /**
  * Auto-extend the CSP so configured Google Fonts load under the default policy
- * (their CSS host into `style-src`, the static host into `font-src`). No-op when
+ * (their CSS host into `style-src`, the static host into `font-src`, and the
+ * static host into `connect-src` for service-worker fetch interception). No-op when
  * the app disabled CSP (`security.contentSecurityPolicy: false`) or uses no
  * Google Fonts. Local (self-hosted) fonts are served from `'self'` and need nothing.
  */
@@ -532,7 +533,10 @@ function applyFontCsp(config: AppConfig): void {
     dirs[name] = Array.from(new Set([...cur, ...adds]));
   };
   if (add.style.length) extend("style-src", ["'self'", "'unsafe-inline'"], add.style);
-  if (add.font.length) extend("font-src", ["'self'", "data:"], add.font);
+  if (add.font.length) {
+    extend("font-src", ["'self'", "data:"], add.font);
+    extend("connect-src", ["'self'", "ws:", "wss:"], add.font);
+  }
 }
 
 /**