allow embed assets to load in iframes, use unicode domain for invite links

packages/api/src/middleware/security.ts

@@ -4,8 +4,9 @@ import fp from "fastify-plugin";
 async function securityPlugin(app: FastifyInstance) {
   app.addHook("onSend", async (req, reply) => {
     const isEmbed = req.url.startsWith("/api/v1/embed/") || req.url.startsWith("/embed/");
+    const isAsset = req.url.startsWith("/assets/") || req.url.startsWith("/favicon") || req.url.startsWith("/icon-") || req.url.endsWith(".js") || req.url.endsWith(".css");
 
-    if (isEmbed) {
+    if (isEmbed || isAsset) {
       // embed routes need to be frameable by third-party sites
       reply.header("Content-Security-Policy", [
         "default-src 'self'",