Add ws://localhost:* to dev CSP connect-src for browser refresh

aspnetcore-browser-refresh.js uses plain ws:// (not wss://) so it was
blocked by the CSP which only listed wss://localhost:*. Both are needed
in dev: ws:// for the dotnet watch browser refresh socket, wss:// for
SignalR.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Web/Program.cs

@@ -634,7 +634,7 @@ app.Use(async (context, next) =>
         : "'self' 'unsafe-inline' https://cdn.jsdelivr.net https://code.jquery.com https://js.stripe.com";
 
     var cspConnectSrc = app.Environment.IsDevelopment()
-        ? "'self' wss://localhost:* https://cdn.jsdelivr.net https://api.stripe.com"  // Allow hot reload WebSocket in dev
+        ? "'self' ws://localhost:* wss://localhost:* https://cdn.jsdelivr.net https://api.stripe.com"  // Allow hot reload WebSocket in dev (ws:// for browser-refresh, wss:// for SignalR)
         : "'self' https://cdn.jsdelivr.net https://api.stripe.com";
 
     context.Response.Headers.Append("Content-Security-Policy",