fix(qa): resolve remaining console errors & network errors on main routes (TEC-3079)

- fix(web): add ws:// to CSP connect-src for Socket.IO WebSocket connections
- fix(web): guard priceChangePct?.d7 / priceChangePct?.d30 against null in KpiStrip
- fix(api): add web-vitals POST to CSRF exclusion in both app.module and shared.module
- fix(api): use controller-relative path (web-vitals) not prefixed path for NestJS .exclude()

Result: 0 console errors, 0 network 4xx/5xx on /, /login, /register, /search

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/app/[locale]/(public)/page.tsx

@@ -139,7 +139,7 @@ function KpiStrip({ city }: { city: string }) {
       <KpiCard
         label="GGI HCM"
         value={data ? formatPriceM2(data.avgPricePerM2) : '—'}
-        delta={data?.priceChangePct.d7}
+        delta={data?.priceChangePct?.d7}
         footnote="Chỉ số giá TB/m²"
         icon={<BarChart3 className="h-3.5 w-3.5" />}
         loading={isLoading}
@@ -147,7 +147,7 @@ function KpiStrip({ city }: { city: string }) {
       <KpiCard
         label="Giá TB"
         value={data ? formatVnd(data.avgPrice) : '—'}
-        delta={data?.priceChangePct.d30}
+        delta={data?.priceChangePct?.d30}
         footnote="Toàn thành phố"
         icon={<Building2 className="h-3.5 w-3.5" />}
         loading={isLoading}