Fix: CSP blockierte GEOINT-Satellitenbilder und externe APIs

Content-Security-Policy erweitert:
- img-src: server.arcgisonline.com (Esri Satellite Tiles)
- connect-src: earthquake.usgs.gov, api.gdeltproject.org
- script-src: unpkg.com (Leaflet.heat Plugin)

src/main.py

@@ -298,11 +298,11 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         response = await call_next(request)
         response.headers["Content-Security-Policy"] = (
             "default-src 'self'; "
-            "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+            "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://unpkg.com; "
             "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; "
             "font-src 'self' https://fonts.gstatic.com; "
-            "img-src 'self' data: https://tile.openstreetmap.de; "
+            "img-src 'self' data: https://tile.openstreetmap.de https://server.arcgisonline.com; "
-            "connect-src 'self' wss: ws:; "
+            "connect-src 'self' wss: ws: https://earthquake.usgs.gov https://api.gdeltproject.org; "
             "frame-ancestors 'none'"
         )
         response.headers["Permissions-Policy"] = (