fix(host): add wss: to CSP connect-src for plugin WebSocket support

[elliotBraem]

Summary

Adds wss: scheme to the CSP connect-src directive in the host security middleware, alongside the existing https: scheme-wide allowance.

Context

Plugins that need WebSocket connections (e.g. nostr relays, streaming APIs) were failing through the host because the CSP connect-src directive didn't include wss:. While plugins can declare connectSrc in their config, the CSP middleware is built once at boot time from the base config — tenant-specific connectSrc values never reached the response headers.

Adding wss: scheme-wide is consistent with the existing https: permissiveness in the same directive, and immediately unblocks all WebSocket connections without requiring a per-request CSP refactor.

Changes

• host/src/middleware/security.ts: Added "wss:" to connectSrc array
• .changeset/wild-ghosts-brake.md: Changeset

Testing

• bun typecheck — passes
• bun lint — passes