fix: add script-src-elem to CSP to allow Clerk authentication scripts

Author: batalabs

nginx.conf.template

@@ -39,7 +39,7 @@ http {
         add_header X-Frame-Options "SAMEORIGIN" always;
         add_header X-Content-Type-Options "nosniff" always;
         add_header X-XSS-Protection "1; mode=block" always;
-        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://clerk.typelets.com https://*.clerk.accounts.dev; script-src-elem 'self' https://clerk.typelets.com https://*.clerk.accounts.dev; style-src 'self' 'unsafe-inline' https://clerk.typelets.com; img-src 'self' data: https: blob:; font-src 'self' data: https://clerk.typelets.com; connect-src 'self' https://clerk.typelets.com https://*.clerk.accounts.dev wss://ws-api.typelets.com https://api.typelets.com; frame-src 'self' https://clerk.typelets.com https://*.clerk.accounts.dev https://challenges.cloudflare.com;" always;
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://clerk.typelets.com https://*.clerk.accounts.dev; script-src-elem 'self' https://clerk.typelets.com https://*.clerk.accounts.dev; style-src 'self' 'unsafe-inline' https://clerk.typelets.com https://fonts.googleapis.com; style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://clerk.typelets.com; img-src 'self' data: https: blob:; font-src 'self' data: https://clerk.typelets.com https://fonts.gstatic.com; connect-src 'self' https://clerk.typelets.com https://*.clerk.accounts.dev wss://ws-api.typelets.com https://api.typelets.com; frame-src 'self' https://clerk.typelets.com https://*.clerk.accounts.dev https://challenges.cloudflare.com; worker-src 'self' blob:;" always;
 
         # === Proxy API requests to backend service ===
         location /api/ {