Security: load every catalogue icon through the server

[SandObserver]

Summary

• Remove the direct cdn.jsdelivr.net entries from iconChain: a name resolves to its local copy, then one /api/icons/cdn request.
• Add throughServer, which maps catalogue CDN URLs to the proxy, and use it for saved icon links and icon picker results.
• Set connect-src 'self' in the default and admin policies. Keep the img-src CDN allowance for demo mode, which loads icons directly.

Testing
All green. Added unit tests for the chain and proxy mapping, an nginx policy test, and an e2e test that the dashboard and Settings make no CDN request.

Changelog

Security

• Icons always load through the server, so the CDN does not learn which services a dashboard shows.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.