fix(web-app): map ws:// relay URL to http:// for CSP connect-src

[Priyanshubhartistm]

Description

createWebApp in src/factories/web-app-factory.ts builds the Content-Security-Policy connect-src directive by deriving an HTTP(S) origin from the relay's WebSocket URL. The wss: case correctly maps to https:, but the else branch assigned the string ':' instead of 'http:'. Because ':' is not a valid scheme, the WHATWG URL API silently
ignores the assignment, so webRelayUrl keeps its ws: protocol and connect-src ends up with a ws://… entry instead of the intended http://… origin.

This one-character fix maps ws: → http::

Related Issue

Closes #700

Motivation and Context

For relays served over plain ws:// (local/dev, Tor, or reverse-proxied setups), the CSP connect-src for the invoices/terms pages was wrong — it advertised a ws:// origin where an http:// origin was intended. This produces an incorrect security header for those deployments. The wss: → https: path was already correct and is unaffected.

How Has This Been Tested?

• pnpm lint — Biome lint passes (328 files, no errors)
• pnpm check:deps — Knip passes
• pnpm run build:check, pnpm run build, pnpm run verify:cli:build — all pass
• pnpm run test:unit (1392 passing), pnpm run test:cli (73 passing),
  pnpm run cover:unit (1393 passing) — all green
• pnpm exec changeset status --since origin/main — changeset present

Environment: Linux, Node/pnpm per .nvmrc, Docker v2.1.0.

Screenshots (if appropriate):

N/A — no visual change.

Types of changes

• Non-functional change (docs, style, minor refactor)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my code changes.
• I added a changeset, or this is docs-only and I added an empty changeset.
• All new and existing tests passed.

[changeset-bot]

🦋 Changeset detected

Latest commit: c309631

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coveralls]

coverage: 67.884% (+0.01%) from 67.874% — Priyanshubhartistm:fix/csp-ws-http-scheme-mapping into cameri:main