fix(csp): allow the self-hosted Umami tracker

[manager]

Follow-up to #176. Our own Content-Security-Policy blocks the tracker: analytics.administration.ae is missing from script-src (the script never loads) and from connect-src (events never send). Adds the host to both lists in next.config.js.

Found while verifying the production release: the origin serves the tag correctly, but no browser would have executed it.

🤖 Generated with Claude Code

[github-actions]

Claude finished @manager's task in 36s —— View job

---

Review: allow the self-hosted Umami tracker in CSP

• Gather context (diff, CSP config, _document.tsx)
• Understand the request
• Review the change
• Post final review

Correct and minimal fix. Verified against src/pages/_document.tsx:16-21: the Umami <script> tag has no data-host-url override, so event beacons POST back to the same origin the script was loaded from (analytics.administration.ae). That means the host genuinely needs to be in both script-src (to load script.js) and connect-src (to send events) — this PR adds exactly that, matching the existing metrics.administration.ae pattern already used for AI Atlas.

No issues found:

• Values are added to the existing .filter(Boolean).join(' ') arrays, consistent with surrounding style.
• Comments (// Self-hosted Umami tracker. / // Self-hosted Umami event collection.) are appropriately terse and explain non-obvious intent.
• No unrelated changes, no hardcoded secrets, no scope creep — a clean 4-line, single-file diff.

Nothing to flag. Approving the change on merits (note: I can't submit a formal GitHub approval per my permissions).