fix(csp): allow blob: worker so the Meta Pixel can emit events

The Meta Pixel (fbevents 2.9.x) dispatches ALL events from a Web Worker created
off a blob: URL. With no worker-src directive, the browser fell back to
script-src (which lacks blob:), so the worker was CSP-blocked and NO pixel
events fired — PageView, CompleteRegistration, everything were 0 in a live
headless test (even a manual fbq('track','PageView') emitted nothing).
connect-src/img-src already allowed facebook.com, so this was the sole
remaining client-side blocker. Adds worker-src 'self' blob: (also unblocks
Remotion's blob worker on the landing demos).

Note: CAPI (server-side) already covers the signup conversion regardless; this
restores the browser pixel for PageView + retargeting/audience events.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/main.ts

@@ -57,6 +57,12 @@ async function bootstrap() {
           ],
           objectSrc: ["'none'"],
           frameSrc: ["https://challenges.cloudflare.com", "https://destek.sase.tr"],
+          // The Meta Pixel (fbevents 2.9.x) dispatches ALL events from a Web Worker
+          // created off a blob: URL. With no worker-src, the browser falls back to
+          // script-src — which lacks blob: — so the worker is CSP-blocked and NO
+          // pixel events fire (PageView, CompleteRegistration, everything were 0
+          // until this). Also unblocks Remotion's blob worker on the demos.
+          workerSrc: ["'self'", "blob:"],
         },
       },
     }),