fix(pcat): capture route'unu bilinen-iyi'ye döndür — prod token capture kurtar

0f2126d'deki agresif capture blocking (stylesheet + yastatic/google-font/ad
domain'leri) prod'da token capture'ı öldürdü: dataimpulse ile 425→0 capture/
saat, tam deploy anında (03:40 UTC), hepsi capture_timeout. RU katalog widget'ı
init olup /v3/api/proxy XHR'ını atmak için CSS'ine ve Yandex-hosted runtime'ına
ihtiyaç duyuyor. Aynı deploy'da emex (HTML-scrape, widget yok) aynı dataimpulse
üzerinden sağlıklı kaldı → sorun pcat-capture'a özgü.

pcat capture blocking'i orijinaline döndürüldü (image/font/media + tracker'lar)
— resim engellemesi zaten çalışıyordu, korunur. Emex blocking (kanıtlanmış
güvenli) ve ipify gate (PCAT_EXIT_IP_PROBE, kapalı) korunur.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/api/src/integrations/parts-catalogs/parts-catalogs-auth.service.ts

@@ -863,37 +863,30 @@ export class PartsCatalogsAuthService implements OnModuleInit, OnModuleDestroy {
         this.logger.debug(`Token intercepted (key=${apiKey.slice(0, 16)}...)`);
       });
 
-      // Block heavy resources to save proxy bandwidth. The capture only needs
-      // the widget's own JS to run and fire its /v3/api/proxy XHR — images,
-      // fonts, CSS and every third-party tag are pure billed residential waste.
+      // Block heavy resources to save proxy bandwidth. Kept intentionally
+      // minimal: an aggressive block (stylesheet + yastatic/font/ad domains)
+      // shipped 2026-07-16 killed token capture on prod (dataimpulse 425→0
+      // captures/h at deploy time — the RU catalog widget needs its CSS and
+      // Yandex-hosted runtime to init and fire the /v3/api/proxy XHR). Only
+      // block what the widget provably never needs: images, fonts, media, and
+      // a few pure analytics/ad domains.
       await page.route("**/*", (route) => {
         const url = route.request().url();
         const type = route.request().resourceType();
 
-        // Block images, fonts, stylesheets, media — never gate the token XHR.
-        if (["image", "font", "stylesheet", "media"].includes(type)) {
+        // Block images, fonts, media
+        if (["image", "font", "media"].includes(type)) {
           return route.abort();
         }
 
-        // Block third-party junk seen in proxy usage: analytics, ad networks,
-        // chat widgets, Google/Yandex assets, and our own ipify egress probe.
-        // NB: never add the widget's runtime CDNs (jsdelivr/unpkg) here — its
-        // JS must load or no token fires; heavy assets are caught by type above.
+        // Block known trackers/analytics
         if (
           url.includes("google-analytics.com") ||
           url.includes("googletagmanager.com") ||
           url.includes("mc.yandex.ru") ||
-          url.includes("yastatic.net") ||
-          url.includes("fonts.googleapis.com") ||
-          url.includes("fonts.gstatic.com") ||
-          url.includes("content-autofill.googleapis.com") ||
           url.includes("facebook.net") ||
           url.includes("doubleclick.net") ||
-          url.includes("hotjar.com") ||
-          url.includes("adsco.re") ||
-          url.includes("displayvertising.com") ||
-          url.includes("tidio.co") ||
-          url.includes("api.ipify.org")
+          url.includes("hotjar.com")
         ) {
           return route.abort();
         }