fix(analytics): CSP'ye Google Ads tag + conversion domain'lerini ekle

CSP script-src googletagmanager.com İÇERMİYORDU → gtag.js hiç yüklenmiyordu →
gtag config/conversion event'i çalışmıyor, _gcl_aw linker cookie set olmuyor,
conversion ping'i Google'a hiç gitmiyor → haftalardır panelde 0 dönüşüm (doğru
AW id + label + kanonik gtag'e rağmen). ASIL bloker buydu — gtag shim (6c936d5)
+ OAuth (685c6af) fix'leri gerekliydi ama tek başına yetmezdi.
- script-src += www.googletagmanager.com
- img-src/connect-src += google.com, googleadservices.com, googleads.g.doubleclick.net
Meta Pixel worker-src ve Sentry ingest ile aynı sınıf CSP-blocking bug.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/api/src/main.ts

@@ -58,6 +58,10 @@ async function bootstrap() {
             "https://connect.facebook.net",
             "https://challenges.cloudflare.com",
             "https://destek.sase.tr",
+            // Google Ads gtag.js (conversion tracking). Its absence here silently
+            // blocked the whole tag from loading → gtag config/conversion never ran
+            // → 0 conversions for weeks despite correct AW id + labels.
+            "https://www.googletagmanager.com",
             "'sha256-T5FzBQBMINFjZ4WLy58SeZ+J7xXzjnQEGlg618CQnhA='",
           ],
           styleSrc: ["'self'", "https:", "'unsafe-inline'"],
@@ -67,6 +71,10 @@ async function bootstrap() {
             "https://storage.sase.tr",
             "https://www.facebook.com",
             "https://destek.sase.tr",
+            // Google Ads conversion + remarketing pixel pings (fire as images).
+            "https://www.google.com",
+            "https://www.googleadservices.com",
+            "https://googleads.g.doubleclick.net",
           ],
           fontSrc: ["'self'", "https:", "data:"],
           mediaSrc: ["'self'", "data:", "https://destek.sase.tr"],
@@ -79,6 +87,12 @@ async function bootstrap() {
             "https://challenges.cloudflare.com",
             "https://destek.sase.tr",
             "wss://destek.sase.tr",
+            // Google Ads gtag config fetch + conversion pings (googleadservices /
+            // google.com 1p-conversion & ccm/collect enhanced-conversion beacons).
+            "https://www.googletagmanager.com",
+            "https://www.google.com",
+            "https://www.googleadservices.com",
+            "https://googleads.g.doubleclick.net",
             // Sentry browser SDK envelope POSTs (otolog org, de region).
             // Without this CSP silently blocks every error/replay upload.
             "https://*.ingest.de.sentry.io",