fix: update CSP for Cloudflare and set CORS_ORIGIN to fix 500 errors

backend/src/middleware/security.js

@@ -9,7 +9,7 @@ export const setupSecurity = (app) => {
       directives: {
         defaultSrc: ["'self'"],
         styleSrc: ["'self'", "'unsafe-inline'"],
-        scriptSrc: ["'self'"],
+        scriptSrc: ["'self'", "https://static.cloudflareinsights.com", "'unsafe-inline'"],
         imgSrc: ["'self'", 'data:', 'https:'],
       },
     },

k8s/app.yaml

@@ -22,6 +22,8 @@ spec:
         env:
         - name: NODE_ENV
           value: "production"
+        - name: CORS_ORIGIN
+          value: "https://market.applaude.net"
         - name: USE_PYTHON_SERVICE
           value: "false"
         - name: DATABASE_URL