fix(opencloud): add CSP config to allow Pocket ID OIDC auth

Browser was blocking fetch of https://auth.basicstack.de/.well-known/openid-configuration
due to missing connect-src directive in Content-Security-Policy.

Adds csp.yaml to the ConfigMap (mounted at /etc/opencloud/csp.yaml) with
extended connect-src that includes auth.basicstack.de and WebSocket origins.
Sets PROXY_CSP_CONFIG_FILE_LOCATION env var so the proxy service picks it up.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/opencloud/opencloud-configmap.yaml

@@ -60,3 +60,15 @@ data:
     gateway:
       storage_registry:
         storage_users_mount_id: ${OC_STORAGE_MOUNT_ID}
+
+  csp.yaml: |
+    directives:
+      connect-src:
+        - "'self'"
+        - "blob:"
+        - "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
+        - "https://update.opencloud.eu/"
+        - "https://opencloud.basicstack.de"
+        - "https://auth.basicstack.de"
+        - "wss://opencloud.basicstack.de"
+        - "wss://auth.basicstack.de"

apps/opencloud/opencloud-deployment.yaml

@@ -165,6 +165,8 @@ spec:
           value: "openid profile email groups"
 
         # Proxy service OIDC configuration
+        - name: PROXY_CSP_CONFIG_FILE_LOCATION
+          value: "/etc/opencloud/csp.yaml"
         - name: PROXY_OIDC_ISSUER
           value: "https://auth.basicstack.de"
         - name: PROXY_OIDC_REWRITE_WELLKNOWN