fix(csp): allow destek.sase.tr for the Chatwoot widget

The live-chat SDK, widget iframe, websocket and avatars are served from
destek.sase.tr; the helmet CSP didn't whitelist it, so the browser
blocked sdk.js (script-src violation) and the widget never loaded.
Add destek.sase.tr to script-/img-/media-/connect-/frame-src (+wss for
ActionCable).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/main.ts

@@ -29,6 +29,7 @@ async function bootstrap() {
             "https://t.sase.tr",
             "https://connect.facebook.net",
             "https://challenges.cloudflare.com",
+            "https://destek.sase.tr",
             "'sha256-T5FzBQBMINFjZ4WLy58SeZ+J7xXzjnQEGlg618CQnhA='",
           ],
           styleSrc: ["'self'", "https:", "'unsafe-inline'"],
@@ -37,9 +38,10 @@ async function bootstrap() {
             "data:",
             "https://storage.sase.tr",
             "https://www.facebook.com",
+            "https://destek.sase.tr",
           ],
           fontSrc: ["'self'", "https:", "data:"],
-          mediaSrc: ["'self'", "data:"],
+          mediaSrc: ["'self'", "data:", "https://destek.sase.tr"],
           connectSrc: [
             "'self'",
             "https://storage.sase.tr",
@@ -47,9 +49,11 @@ async function bootstrap() {
             "https://www.facebook.com",
             "https://connect.facebook.net",
             "https://challenges.cloudflare.com",
+            "https://destek.sase.tr",
+            "wss://destek.sase.tr",
           ],
           objectSrc: ["'none'"],
-          frameSrc: ["https://challenges.cloudflare.com"],
+          frameSrc: ["https://challenges.cloudflare.com", "https://destek.sase.tr"],
         },
       },
     }),