chore(security): confirm in production before dropping cloudflareinsights.com from connect-src #98

Follow-up to #69.

Problem #

#69's acceptance criteria say https://cloudflareinsights.com is "removed if production shows beacons going to /cdn-cgi/rum". The change removed it from connect-src, but nothing records that production was checked. If Cloudflare Web Analytics still posts to cloudflareinsights.com, the beacon is now blocked by CSP and analytics silently stop.

Evidence #

• lib/security-headers.ts:40: connect-src no longer lists https://cloudflareinsights.com.
• #69: the acceptance criterion that makes the removal depend on what production shows.

Expected #

The owner checks a production page's network panel: beacons go to /cdn-cgi/rum on the site's own origin and no CSP violation is reported for cloudflareinsights.com. If beacons still go to cloudflareinsights.com, the entry comes back.

Acceptance criteria #

• Production is checked and the result is noted on this issue.
• connect-src matches what production needs.

Out of scope #

Other CSP changes.