fix: add CSP headers to allow connections to *.objectstack.ai domain

The CSP policy was blocking connections to https://demo.objectstack.ai
because it only allowed https://*.objectstack.io. This adds explicit
CSP headers in vercel.json to allow both *.objectstack.io and
*.objectstack.ai domains in the connect-src directive.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Claude

apps/studio/vercel.json

@@ -17,6 +17,15 @@
     }
   },
   "headers": [
+    {
+      "source": "/(.*)",
+      "headers": [
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' ws: wss: http://localhost:* https://*.objectstack.io https://*.objectstack.ai https://*.sentry.io"
+        }
+      ]
+    },
     {
       "source": "/assets/(.*)",
       "headers": [