fix(csp): allow stun:/turn: schemes in connect-src

Chrome enforces CSP connect-src for WebRTC ICE servers. Without the
stun/stuns/turn/turns schemes the browser silently dropped STUN/TURN
candidates (only host candidates remained), breaking custom-server
connectivity test results and real cross-network ICE.

index.html

@@ -8,7 +8,7 @@
            script-src 'self';
            style-src 'self' 'unsafe-inline';
            font-src 'self' https://fonts.gstatic.com data:;
-           connect-src 'self' https: wss: ws:;
+           connect-src 'self' https: wss: ws: stun: stuns: turn: turns:;
            img-src 'self' data: https:;
            media-src 'none';
            object-src 'none';