fix: Add CSP connectSrc directive for AI API calls

- Added connectSrc to Content Security Policy
- Allow connections to OpenAI, 智谱AI, Azure OpenAI, Anthropic, and Google AI APIs
- Fixes CSP violation error when calling external AI services in production
- Resolves: 'Refused to connect because it violates the document's Content Security Policy'

server/index.cjs

@@ -36,6 +36,14 @@ app.use(helmet({
       styleSrc: ["'self'", "'unsafe-inline'"],
       scriptSrc: ["'self'"],
       imgSrc: ["'self'", "data:", "https:"],
+      connectSrc: [
+        "'self'",
+        "https://api.openai.com",
+        "https://open.bigmodel.cn",
+        "https://*.openai.azure.com",
+        "https://api.anthropic.com",
+        "https://generativelanguage.googleapis.com"
+      ],
     },
   },
   crossOriginEmbedderPolicy: false