fix(observability): whitelist Sentry ingest in CSP connect-src

The browser Sentry SDK initialised fine (DSN reached the bundle,
__SENTRY__ carrier registered) but envelope POSTs were silently
blocked by the existing CSP — `connect-src` didn't list any Sentry
host. Playwright verification on dev.sase.tr confirmed zero requests
to *.sentry.io even after a deliberate uncaught error.

Adds https://*.ingest.de.sentry.io (otolog org lives in the EU/de
region; this matches both the python and sase-web project DSNs).

apps/api/src/main.ts

@@ -51,6 +51,9 @@ async function bootstrap() {
             "https://challenges.cloudflare.com",
             "https://destek.sase.tr",
             "wss://destek.sase.tr",
+            // Sentry browser SDK envelope POSTs (otolog org, de region).
+            // Without this CSP silently blocks every error/replay upload.
+            "https://*.ingest.de.sentry.io",
           ],
           objectSrc: ["'none'"],
           frameSrc: ["https://challenges.cloudflare.com", "https://destek.sase.tr"],