Fix WebSocket URL scheme and drop stale dev-only CSP override

BACKEND_WS_URL was set to https://, but new WebSocket() requires a
ws://wss:// scheme and throws a SyntaxError otherwise. Also removes
the Firefox-only CSP override that worked around Firefox upgrading a
plaintext ws:// dev connection to wss:// — now that the backend is
real wss:// behind TLS, there's nothing left to upgrade.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Tn7uDYjTuZEbLPwpEiSCUw

src/shared/config.ts

@@ -1,11 +1,6 @@
 /**
- * Nexa backend location. Dev-only default — swap for the real deployed
- * backend host before shipping (see backend/CLAUDE.md, "Relationship to the
- * frontend"). `host_permissions` in wxt.config.ts must be kept in sync with
- * this host.
+ * Nexa backend location. `host_permissions` in wxt.config.ts must be kept in
+ * sync with this host.
  */
-// Port 8080, deliberately not 3000 — that's WXT/Vite's dev server port for
-// this extension, and colliding with it breaks the dev popup silently (its
-// script tags point at Vite, but the backend answers instead).
 export const BACKEND_HTTP_URL = 'https://api.osias.trade';
-export const BACKEND_WS_URL = 'https://api.osias.trade/ws';
+export const BACKEND_WS_URL = 'wss://api.osias.trade/ws';