- fix(web): add ws:// to CSP connect-src for Socket.IO WebSocket connections
- fix(web): guard priceChangePct?.d7 / priceChangePct?.d30 against null in KpiStrip
- fix(api): add web-vitals POST to CSRF exclusion in both app.module and shared.module
- fix(api): use controller-relative path (web-vitals) not prefixed path for NestJS .exclude()
Result: 0 console errors, 0 network 4xx/5xx on /, /login, /register, /search
Co-Authored-By: Paperclip <noreply@paperclip.ing>