release: allow the Umami tracker in CSP

[manager]

Ships the CSP fix from #178 to production, so the tracker shipped in #176 can actually load and send events.

Verified on staging: the rebuilt container is healthy, the site answers 200, and the served CSP header now lists analytics.administration.ae in both script-src and connect-src.

🤖 Generated with Claude Code

[github-actions]

Claude finished @manager's task in 44s —— View job

---

Reviewing PR #179

• Gather context (diff, related PR fix(csp): allow the self-hosted Umami tracker #178)
• Review next.config.js change
• Post review feedback

Summary

This is a release PR (dev → main) that ships the CSP fix from #178: it adds https://analytics.administration.ae to both script-src (next.config.js:37) and connect-src (next.config.js:48) so the self-hosted Umami tracker introduced in #176 can load its script and send events.

Assessment: LGTM. The change is minimal, config-only, and matches the existing array-based CSP pattern in next.config.js (each source is a commented string entry, joined via filter(Boolean).join(' ')). No React/TS/styling surface is touched, so none of the usual review dimensions (hooks, hydration, a11y, SCSS) apply here.

A few things worth noting, not blockers:

• Both entries are commented (// Self-hosted Umami tracker. / // Self-hosted Umami event collection.), consistent with the file's existing style — good.
• analytics.administration.ae is distinct from the already-allowed metrics.administration.ae in connect-src (next.config.js:46) — worth double-checking these are in fact two separate legitimate endpoints and not a typo/duplicate, but the PR description confirms this was verified live on staging (CSP header inspection, 200 response).
• Scope is correctly narrow: no wildcard or overly broad CSP directive was introduced.

Since this PR only promotes an already-reviewed fix (#178) to main, and staging verification is documented in the PR description, there's nothing further to flag.