fix(csp): allow Cloudflare Web Analytics in Content-Security-Policy

The enforced CSP blocked the Cloudflare beacon, so Web Analytics wasn't
collecting anything on the live site. Add https://static.cloudflareinsights.com
to script-src (loads beacon.min.js) and https://cloudflareinsights.com to
connect-src (RUM data POST). Also documented that re-enabling the Preferred
Sources pill will need https://news.google.com in the CSP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/preferred-sources.md

@@ -26,7 +26,12 @@ readers to add it as a preferred source.
    (publishercenter.google.com).
 3. Re-enable: in `preferred-source.js`, restore `addPill();` in `init()`
    (uncomment it). Pill renders on homepage / News hub / Blog hub, under the H1.
-4. Verify the deeplink now returns MSOS (no longer "No results").
+4. **CSP:** the pill loads Google's SwG library from `https://news.google.com`.
+   Add it to `script-src` (and `connect-src`) in the `.htaccess`
+   Content-Security-Policy, or `publisher.js` will be blocked (same class of
+   issue that blocked the Cloudflare beacon until `static.cloudflareinsights.com`
+   was allowlisted).
+5. Verify the deeplink now returns MSOS (no longer "No results").
 
 ## Related (also shipped 2026-08-30)
 - Cookie banner: benefit-led copy + **analytics-only** consent (`consent.js`).