CSP: allow the footer's built.indie + pwamart badges (#78)

Anthony: "add a pwamart.com badge to all our sites". @profullstack/footer carries the built.indie badge and, since 0.2.6, the pwamart badge (https://pwamart.com/for.svg?site=<homepage>); this site's CSP img-src blocked both images. It now names the two hosts (not an open img-src). No ad units.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: ralyodio

apps/web/next.config.mjs

@@ -12,7 +12,7 @@ const csp = [
   "default-src 'self'",
   "script-src 'self' 'unsafe-inline'",
   "style-src 'self' 'unsafe-inline'",
-  "img-src 'self' data:",
+  "img-src 'self' data: https://built.indie.pit.world https://pwamart.com",
   "font-src 'self' data:",
   // The download page reads release metadata from the GitHub API.
   "connect-src 'self' https://api.github.com",