fix(csp): allow self-hosted Supabase Realtime WebSocket in connect-src (#954)

connect-src listed the https Supabase origin plus wss://*.supabase.co,
but never the wss variant of a self-hosted Supabase URL. Supabase
Realtime opens wss://<host>/realtime/v1/websocket, which CSP blocked;
WebKit throws synchronously on a CSP-blocked new WebSocket(), so Safari
unmounted the dashboard into the error boundary (Chromium only logs).

- next.config.ts: add supabaseWsUrl (NEXT_PUBLIC_SUPABASE_WS_URL, or
  the Supabase URL with https to wss / http to ws) to connect-src
- Dockerfile: bake a __NEXT_PUBLIC_SUPABASE_WS_URL__ sentinel, since
  the CSP is fixed at build time and only sed-substituted at runtime
- docker-entrypoint.sh: derive the wss origin from
  NEXT_PUBLIC_SUPABASE_URL unless overridden, substitute the sentinel
- .env.docker.example: document the optional override

Hosted is unaffected: the wss form of *.supabase.co was already
allowlisted, so the added token is redundant there.

Fixes #893

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.env.docker.example

@@ -6,3 +6,8 @@ CRON_SECRET=generate-a-random-secret
 
 # Self-hosted (Docker) flag: disables application-side MFA enforcement.
 NEXT_PUBLIC_SELF_HOSTED=true
+
+# Optional: WebSocket origin allowed for Supabase Realtime in the CSP.
+# Defaults to NEXT_PUBLIC_SUPABASE_URL with https:// replaced by wss://
+# (http:// by ws://). Set only if Realtime is served from another origin.
+# NEXT_PUBLIC_SUPABASE_WS_URL=wss://your-project.supabase.co