fix: remove CSP meta tag to prevent runtime breakage

The Content-Security-Policy was too restrictive for a Capacitor mobile
app. connect-src only allowed *.numbersprotocol.io, which would silently
block requests to bubble.io APIs (actions, orders, NUM price), GoPro
local server (10.5.5.9), and AppsFlyer analytics at runtime.

CSP for Capacitor apps requires a dedicated effort with comprehensive
domain inventory and full QA coverage across all features.

Author: Omni

src/index.html

@@ -14,19 +14,6 @@
     <meta name="format-detection" content="telephone=no" />
     <meta name="msapplication-tap-highlight" content="no" />
 
-    <meta
-      http-equiv="Content-Security-Policy"
-      content="default-src 'self';
-               frame-src https://*.numbersprotocol.io https://*.bubble.io;
-               connect-src https://*.numbersprotocol.io;
-               script-src 'self';
-               style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
-               font-src 'self' https://fonts.gstatic.com;
-               img-src 'self' data: blob:;
-               media-src 'self' blob:;
-               object-src 'none';"
-    />
-
     <link
       rel="preload"
       as="image"