fix(mindspace): guard published pages against blocked CDN scripts

Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP.

Co-authored-by: Cursor <cursoragent@cursor.com>

server.mjs

@@ -109,6 +109,7 @@ import {
   stripPublicationHtmlCspMeta,
 } from './plaza-embed.mjs';
 import { publishedPageCsp } from './mindspace-published-page-csp.mjs';
+import { rewriteKnownCdnScriptSources } from './mindspace-published-script-localize.mjs';
 import { createMindSpaceAgentRunner } from './mindspace-agent-runner.mjs';
 import {
   analyzeChatMessageForSave,
@@ -5833,6 +5834,7 @@ async function sendPublishFile(req, res, filePath, { isOwner = true } = {}) {
     return;
   }
   html = await ensurePublicHtmlPrivateAssetsMaterialized(filePath, html);
+  html = rewriteKnownCdnScriptSources(html).html;
   html = preparePublicHtmlAssetDelivery(html, INTERNAL_AGENT_SECRET);
   const embed = isPlazaEmbedRequest(req.query);
   if (embed) {