fix(csp): Allow cdn.jsdelivr.net for Swagger UI assets

Added cdn.jsdelivr.net to Content Security Policy directives to allow
Swagger UI assets (JavaScript, CSS, and images) to load properly.

Updated CSP directives:
- CSP_SCRIPT_SRC: Added cdn.jsdelivr.net for swagger-ui-bundle.js
- CSP_STYLE_SRC: Added cdn.jsdelivr.net for swagger-ui.css
- CSP_IMG_SRC: Added cdn.jsdelivr.net for favicon

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

smoothschedule/config/settings/multitenancy.py

@@ -239,17 +239,20 @@ CSP_SCRIPT_SRC = (
     "https://connect-js.stripe.com",
     "https://www.googletagmanager.com",
     "https://www.google-analytics.com",
+    "https://cdn.jsdelivr.net",  # Required for Swagger UI
     "blob:",  # Required for Stripe
 )
 CSP_STYLE_SRC = (
     "'self'",
     "'unsafe-inline'",  # Required for Stripe and many UI libraries
+    "https://cdn.jsdelivr.net",  # Required for Swagger UI
 )
 CSP_IMG_SRC = (
     "'self'",
     "data:",
     "https://*.stripe.com",
     "https://www.google-analytics.com",
+    "https://cdn.jsdelivr.net",  # Required for Swagger UI
 )
 CSP_CONNECT_SRC = (
     "'self'",