fix: update VITE_SERVER_URL in environment files for consistency

Author: hotlong

apps/console/.env.development

@@ -1,5 +1,5 @@
 # Development: connect to a local or remote ObjectStack server.
 # Set VITE_SERVER_URL to your dev server (e.g. http://localhost:3000 or https://demo.objectstack.ai).
 # Leave empty to use same-origin (when Console is served by the server itself).
-VITE_SERVER_URL=http://localhost:3000
+VITE_SERVER_URL=https://demo.objectstack.ai
 VITE_USE_MOCK_SERVER=false

apps/console/.env.production

@@ -1,4 +1,4 @@
 # Production: connect to the ObjectStack server.
 # Set VITE_SERVER_URL to the server origin, or leave empty for same-origin.
-VITE_SERVER_URL=
+VITE_SERVER_URL=https://demo.objectstack.ai
 VITE_USE_MOCK_SERVER=false

apps/console/index.html

@@ -8,7 +8,6 @@
       - For stricter CSP, serve headers via your web server (see docs/deployment.md) and use
         nonces or hashes instead of 'unsafe-inline'.
     -->
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' ws: wss: http://localhost:* https://*.objectstack.io https://*.sentry.io; worker-src 'self' blob:; frame-src 'self';" />
     <link rel="icon" type="image/svg+xml" href="/vite.svg" id="favicon" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
     <meta name="mobile-web-app-capable" content="yes" />