Allow Turnstile in frontend CSP

next.config.ts

@@ -22,9 +22,8 @@ const baseSecurityHeaders = [
 
 // Deliberately NOT applied to /admin or /api: Payload's admin bundle isn't
 // audited here for CSP compatibility, and API routes serve data, not HTML,
-// so a content policy doesn't apply to them anyway. connect-src stays broad
-// because the WebRTC call pages connect to the separately hosted LiveKit SFU
-// at runtime. style-src needs
+// so a content policy doesn't apply to them anyway. connect-src permits the
+// separately hosted LiveKit SFU and Cloudflare Turnstile at runtime. style-src needs
 // 'unsafe-inline' because Next App Router emits inline RSC flight/bootstrap
 // scripts that are required for hydration. script-src allows 'unsafe-eval'
 // only in dev, matching Next's own documented CSP guidance - React uses eval
@@ -33,12 +32,13 @@ const baseSecurityHeaders = [
 const isDev = process.env.NODE_ENV === "development";
 const frontendCSP = [
   "default-src 'self'",
-  `script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""}`,
+  `script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com${isDev ? " 'unsafe-eval'" : ""}`,
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: blob:",
   "font-src 'self' data:",
-  "connect-src 'self' https: wss: stun: turn: turns:",
+  "connect-src 'self' https://challenges.cloudflare.com wss: stun: turn: turns:",
   "media-src 'self' blob:",
+  "frame-src 'self' https://challenges.cloudflare.com",
   "frame-ancestors 'self'",
   "base-uri 'self'",
   "form-action 'self'",