fix(csp): allow Formbricks SDK in script-src

@formbricks/js is a loader shim that injects the real SDK as an external
script from anket.sase.tr — connect-src alone wasn't enough; the browser
blocked /js/formbricks.umd.cjs and no survey could render.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/src/main.ts

@@ -30,6 +30,9 @@ async function bootstrap() {
             "https://connect.facebook.net",
             "https://challenges.cloudflare.com",
             "https://destek.sase.tr",
+            // @formbricks/js is only a loader shim — the real SDK is injected as
+            // an external <script> from the Formbricks host (like Chatwoot's sdk.js).
+            "https://anket.sase.tr",
             "'sha256-T5FzBQBMINFjZ4WLy58SeZ+J7xXzjnQEGlg618CQnhA='",
           ],
           styleSrc: ["'self'", "https:", "'unsafe-inline'"],