fix: allow Umami tracking script in Content Security Policy

The script was already in layout.tsx but CSP blocked both loading
and sending beacons to tracking.thewrightserver.net.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

next.config.ts

@@ -2,11 +2,11 @@ import type { NextConfig } from "next";
 
 const CSP = [
   "default-src 'self'",
-  "script-src 'self' 'unsafe-inline'",  // Next.js requires unsafe-inline for hydration
+  "script-src 'self' 'unsafe-inline' https://tracking.thewrightserver.net",  // Next.js requires unsafe-inline for hydration
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data:",
   "font-src 'self'",
-  "connect-src 'self' https://queue-times.com",
+  "connect-src 'self' https://queue-times.com https://tracking.thewrightserver.net",
   "frame-ancestors 'none'",
 ].join("; ");