fix: allow http://localhost in dev-build CSP

[AquiGorka]

Summary

PR #18 added connect-src 'self' https://us.i.posthog.com https://* to the extension_pages CSP. Chromium MV3 applies that to the background service worker too, so every wallet→chain fetch over plain http (incl. localhost) is now blocked. The recording-rig + local-dev pairing flows hit http://localhost:8000/soroban/rpc, which means the wallet's add-private-channel auth() read fails with ColibriError SIM_002: The transaction could not be simulated!, and downstream deposit / send / withdraw / receive inherit the same TypeError: Failed to fetch.

This widens connect-src with http://localhost:* only when DEV=1, so:

• deno task build (dev): manifest CSP includes http://localhost:* → SW can talk to local-dev's Soroban RPC.
• deno task build-prod (release.yml): manifest is copied unchanged → CWS / AMO artifact keeps the tight https-only CSP.

Repro / verification

From the wallet's service worker against this branch's dev build:

http-external (http://example.com)             → THREW Failed to fetch  ✓ prod-tight still
http-localhost (http://localhost:8000/)        → 200                    ✓ unblocked
https-stellar (https://horizon.stellar.org/)   → 200                    ✓ unchanged

Production build (deno task build-prod) emits the manifest verbatim — diff against manifest.json is zero.

Test plan

• deno fmt --check — clean
• deno lint — clean
• deno task build — manifest CSP gains http://localhost:*
• deno task build-prod — manifest CSP unchanged from source
• Service-worker fetch probe confirms http://localhost:8000 unblocked on dev, https fetches unchanged
• Spec 03 private-transfer from the recording rig clears the create-channel step (will re-run on the local-dev branch once this merges)