[BUG] CSP connect-src builds a malformed URL for non-TLS relays (':' instead of 'http:')

[Priyanshubhartistm]

Describe the bug

In src/factories/web-app-factory.ts the Content-Security-Policy is built by deriving an HTTP(S) URL from the relay's WebSocket URL:

const webRelayUrl = new URL(relayUrl.toString())
webRelayUrl.protocol = (relayUrl.protocol === 'wss:') ? 'https:' : ':'

The else branch is clearly meant to map ws: → http:, but it assigns the string ':', which is not a valid scheme. Assigning an invalid scheme via the WHATWG URL API is silently ignored, so webRelayUrl keeps the ws:/wss: protocol, and the connect-src directive ends up with a ws://… entry instead of the intended http://… origin.

For relays served over plain ws:// (local/dev, Tor, or reverse-proxied setups), the CSP connect-src for the invoices/terms pages is therefore wrong.

Expected behavior

webRelayUrl.protocol = (relayUrl.protocol === 'wss:') ? 'https:' : 'http:'

System: Linux, Docker, v2.1.0