fix: CSP configuration for API and media access

- Add https://api.classroomio.com to connect-src for API calls
- Add https://*.r2.cloudflarestorage.com for Cloudflare R2 storage
- Add media-src directive to allow video/document loading
- Fixes CSP violations blocking video downloads and API requests

Resolves CSP errors preventing presigned URL requests and media playback.

apps/dashboard/svelte.config.js

@@ -44,15 +44,18 @@ const config = {
         ],
         'font-src': ['self', 'https://fonts.gstatic.com', 'https://cdn.plyr.io'],
         'img-src': ['self', 'data:', 'https:'],
+        'media-src': ['self', 'https:', 'data:'],
         'frame-src': ['self', 'https://www.youtube.com', 'https://youtube.com'],
         'connect-src': [
           'self',
           'https://*.supabase.co',
           'https://pgrest.classroomio.com',
+          'https://api.classroomio.com',
           'https://assets.cdn.clsrio.com',
           'https://cdn.plyr.io',
           'https://eu.i.posthog.com',
           'https://umami.hz.oncws.com',
+          'https://*.r2.cloudflarestorage.com',
           'http://localhost:54321',
           'ws://localhost:54321',
           'wss://*.classroomio.com',
@@ -88,15 +91,18 @@ const config = {
         ],
         'font-src': ['self', 'https://fonts.gstatic.com', 'https://cdn.plyr.io'],
         'img-src': ['self', 'data:', 'https:'],
+        'media-src': ['self', 'https:', 'data:'],
         'frame-src': ['self', 'https://www.youtube.com', 'https://youtube.com'],
         'connect-src': [
           'self',
           'https://*.supabase.co',
           'https://pgrest.classroomio.com',
+          'https://api.classroomio.com',
           'https://assets.cdn.clsrio.com',
           'https://cdn.plyr.io',
           'https://eu.i.posthog.com',
           'https://umami.hz.oncws.com',
+          'https://*.r2.cloudflarestorage.com',
           'http://localhost:54321',
           'ws://localhost:54321',
           'wss://*.supabase.co',