fix(security): remover header CSP de respostas de API

CSP não tem efeito em respostas JSON e expunha domínios
internos (Umami, Supabase, logo.dev) em endpoints públicos.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/proxy.ts

@@ -101,7 +101,9 @@ export default async function proxy(request: NextRequest) {
 	}
 
 	const response = NextResponse.next();
-	response.headers.set("Content-Security-Policy", buildCsp());
+	if (!pathname.startsWith("/api/")) {
+		response.headers.set("Content-Security-Policy", buildCsp());
+	}
 	return response;
 }