fix(csp): allow Supabase Storage in frame-src for PDF previews (#411)

* fix(csp): allow Supabase Storage URLs in frame-src for PDF previews

The invoice-inbox workspace renders attached PDFs in an <iframe> sourced
from a Supabase Storage signed URL. CSP frame-src was 'self' only, so
Firefox/Chrome blocked the embed with "Det här innehållet har blockerats"
even though extraction worked and the inbox row landed correctly.

Whitelist *.supabase.co alongside the existing self/Activepieces entries.
The signed URL is short-lived (Supabase default) so the exposure is
minimal — same trust boundary we already accept on connect-src.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(csp): scope frame-src to our Supabase project, not the wildcard

Per Greptile review on #411. supabaseUrl (NEXT_PUBLIC_SUPABASE_URL) is
already in scope and resolves to <project-ref>.supabase.co, which is
where our Storage signed URLs live. Using it instead of the *.supabase.co
wildcard prevents the app from being able to iframe content from any
other Supabase tenant.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

next.config.ts

@@ -14,7 +14,7 @@ const cspDirectives = [
   "img-src 'self' data: blob: https:",
   "font-src 'self'",
   "worker-src 'self' blob:",
-  `frame-src 'self'${activepiecesUrl ? ` ${activepiecesUrl}` : ""}`,
+  `frame-src 'self' ${supabaseUrl}${activepiecesUrl ? ` ${activepiecesUrl}` : ""}`,
   "frame-ancestors 'none'",
 ].join("; ");