fix(security): close remaining CSP report-only gaps, make Sentry sourcemap upload verbose for debugging

- connect-src: allow *.fastly.mux.com (Mux HLS chunks/manifests via Fastly
  edge, dynamic regional subdomains) and *.litix.io (Mux Data beacon uses
  inferred.litix.io, not covered by the exact litix.io entry)
- media-src: allow image.mux.com (storyboard.vtt thumbnail track)
- next.config.ts: silent:true -> silent:false + debug:true so the next
  Docker build surfaces what the Sentry/GlitchTip sourcemap upload plugin
  actually does (still minified stacktraces in GlitchTip despite the
  build-arg fix in b469389)

next.config.ts

@@ -44,9 +44,12 @@ export default withSentryConfig(withNextIntl(nextConfig), {
   org: process.env.SENTRY_ORG,
   project: process.env.SENTRY_PROJECT,
   authToken: process.env.SENTRY_AUTH_TOKEN,
-  silent: true,
-  // No auth token configured on this self-hosted deploy yet — skip
-  // source-map upload rather than failing the Docker build.
+  // Temporarily verbose (was silent: true) — GlitchTip still shows minified
+  // stacktraces after the build-arg fix in b469389, so the next deploy needs
+  // to surface the upload plugin's actual log instead of swallowing it.
+  // Revert to silent: true once a successful upload is confirmed.
+  silent: false,
+  debug: true,
   sourcemaps: { disable: !process.env.SENTRY_AUTH_TOKEN },
   disableLogger: true,
 });

src/proxy.ts

@@ -101,9 +101,17 @@ export default clerkMiddleware(
           "https://stream.mux.com",
           "https://image.mux.com",
           "https://litix.io",
+          "https://*.litix.io",
+          "https://*.fastly.mux.com",
           "https://storage.googleapis.com",
         ],
-        "media-src": ["self", "blob:", "https://stream.mux.com", "https://*.edgemv.mux.com"],
+        "media-src": [
+          "self",
+          "blob:",
+          "https://stream.mux.com",
+          "https://*.edgemv.mux.com",
+          "https://image.mux.com",
+        ],
         "font-src": ["self", "data:"],
         "frame-ancestors": ["none"],
         "object-src": ["none"],