fix(csp): allow external/data fonts so email webfonts render

The page CSP set font-src 'self', which blocked fonts referenced by
rendered email CSS (brand webfonts loaded over https). Allow https:/data:
for font-src. Email bodies render inside the sandboxed iframe, which keeps
its own stricter blocking-mode font-src for privacy.

proxy.ts

@@ -112,7 +112,7 @@ export async function proxy(request: NextRequest) {
     `script-src ${scriptSrc}`,
     `style-src 'self' 'unsafe-inline'`,
     `img-src 'self' data: blob: https:`,
-    `font-src 'self'`,
+    `font-src 'self' https: data:`,
     `connect-src ${connectSrc}`,
     frameSrc,
     `object-src 'self' blob:`,