fix(dashboard): stop ERR_CONTENT_DECODING_FAILED on auth/proxy (#779)

* fix(dashboard): prevent ERR_CONTENT_DECODING_FAILED on API proxy

Node fetch decompresses gzip/br upstream bodies while leaving
Content-Encoding set, so browsers fail auth/proxy responses with
net::ERR_CONTENT_DECODING_FAILED. Request identity encoding and strip
encoding headers from proxied responses. Also allow data: fonts in CSP
and skip UserJot on self-hosted.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

* fix(dashboard): preserve Set-Cookie and use Jest for proxy tests

Copy Set-Cookie via getSetCookie/append so multi-cookie auth responses
are not collapsed on Expires commas. Convert proxy tests to Jest and
add CSP domain normalization coverage.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

apps/dashboard/src/lib/utils/services/userjot/index.ts

@@ -1,4 +1,5 @@
 import { dev } from '$app/environment';
+import { PUBLIC_IS_SELFHOSTED } from '$env/static/public';
 import { get } from 'svelte/store';
 import { globalStore } from '$lib/utils/store/app';
 
@@ -8,6 +9,7 @@ let isInitialized = false;
 
 function isWidgetAllowed(): boolean {
   if (dev) return false;
+  if (PUBLIC_IS_SELFHOSTED === 'true') return false;
   if (get(globalStore).isOrgSite) return false;
 
   return true;
@@ -30,7 +32,9 @@ function ensureSdkLoaded(): void {
   script.type = 'module';
   script.async = true;
   script.src = 'https://cdn.userjot.com/sdk/v2/uj.js';
-  const nonce = document.querySelector('script[nonce]')?.getAttribute('nonce');
+  // Browsers hide the nonce attribute in the DOM; read via the IDL property.
+  const nonceSource = document.querySelector('script[nonce]') as HTMLScriptElement | null;
+  const nonce = nonceSource?.nonce || nonceSource?.getAttribute('nonce');
   if (nonce) script.setAttribute('nonce', nonce);
   document.head.appendChild(script);
 }