fix: allow storage.sase.tr in CSP for schema images

Helmet's default CSP blocked images from storage.sase.tr (different
origin). Add it to img-src and connect-src directives.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/main.ts

@@ -17,7 +17,22 @@ async function bootstrap() {
   app.setGlobalPrefix("api");
 
   // Security headers
-  app.use(helmet());
+  app.use(
+    helmet({
+      contentSecurityPolicy: {
+        directives: {
+          defaultSrc: ["'self'"],
+          scriptSrc: ["'self'"],
+          styleSrc: ["'self'", "https:", "'unsafe-inline'"],
+          imgSrc: ["'self'", "data:", "https://storage.sase.tr"],
+          fontSrc: ["'self'", "https:", "data:"],
+          connectSrc: ["'self'", "https://storage.sase.tr"],
+          objectSrc: ["'none'"],
+          frameSrc: ["'none'"],
+        },
+      },
+    }),
+  );
 
   app.enableCors({
     origin: corsOrigins,