fix: update CSP to allow PostHog analytics scripts and connections

- Add PostHog domains to script-src and connect-src CSP directives
- Updated both development (index.html) and production (nginx.conf) CSP
- Allows https://eu.i.posthog.com and https://eu-assets.i.posthog.com

pwa/index.html

@@ -5,6 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/icons/favicon-32.svg" />
     <link rel="apple-touch-icon" href="/icons/apple-touch-icon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://eu-assets.i.posthog.com; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://api.placebo.mk https://cms.placebo.mk https://app.placebo.mk wss://api.placebo.mk https://eu.i.posthog.com https://eu-assets.i.posthog.com; manifest-src 'self';">
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&family=IBM+Plex+Mono:wght@400;500;600;700&display=swap" rel="stylesheet">