fix(csp): allow Meta Pixel sources in helmet CSP

fbevents.js was blocked by script-src; tracking pings to
www.facebook.com/tr/ also need connect-src + img-src entries
(Meta fires both XHR and image-pixel tracking).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/api/src/main.ts

@@ -27,13 +27,25 @@ async function bootstrap() {
           scriptSrc: [
             "'self'",
             "https://t.sase.tr",
+            "https://connect.facebook.net",
             "'sha256-T5FzBQBMINFjZ4WLy58SeZ+J7xXzjnQEGlg618CQnhA='",
           ],
           styleSrc: ["'self'", "https:", "'unsafe-inline'"],
-          imgSrc: ["'self'", "data:", "https://storage.sase.tr"],
+          imgSrc: [
+            "'self'",
+            "data:",
+            "https://storage.sase.tr",
+            "https://www.facebook.com",
+          ],
           fontSrc: ["'self'", "https:", "data:"],
           mediaSrc: ["'self'", "data:"],
-          connectSrc: ["'self'", "https://storage.sase.tr", "https://t.sase.tr"],
+          connectSrc: [
+            "'self'",
+            "https://storage.sase.tr",
+            "https://t.sase.tr",
+            "https://www.facebook.com",
+            "https://connect.facebook.net",
+          ],
           objectSrc: ["'none'"],
           frameSrc: ["'none'"],
         },