docs(api): complete OpenAPI/Swagger documentation for all endpoints

- Add Swagger decorators (@ApiTags, @ApiOperation, @ApiResponse, @ApiParam,
  @ApiBearerAuth) to MCP transport controller — the only controller missing them
- Add reviews and mcp tags to DocumentBuilder config
- Enable JSON spec export at /api/v1/docs-json
- Update Helmet CSP to allow Swagger UI assets from cdn.jsdelivr.net

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/main.ts

@@ -43,10 +43,13 @@ async function bootstrap() {
     .addTag('admin', 'Admin panel operations')
     .addTag('notifications', 'Notification history & preferences')
     .addTag('analytics', 'Market reports & price analytics')
+    .addTag('reviews', 'Property reviews & ratings')
+    .addTag('mcp', 'Model Context Protocol server transport')
     .build();
   const document = SwaggerModule.createDocument(app, swaggerConfig);
   SwaggerModule.setup('api/v1/docs', app, document, {
     swaggerOptions: { persistAuthorization: true },
+    jsonDocumentUrl: 'api/v1/docs-json',
   });
 
   // ── Security Headers (Helmet) ──
@@ -55,8 +58,8 @@ async function bootstrap() {
       contentSecurityPolicy: {
         directives: {
           defaultSrc: ["'self'"],
-          scriptSrc: ["'self'"],
-          styleSrc: ["'self'", "'unsafe-inline'"],
+          scriptSrc: ["'self'", "'unsafe-inline'", 'https://cdn.jsdelivr.net'],
+          styleSrc: ["'self'", "'unsafe-inline'", 'https://cdn.jsdelivr.net'],
           imgSrc: ["'self'", 'data:', 'https:', 'blob:'],
           connectSrc: ["'self'"],
           fontSrc: ["'self'", 'data:'],