feat(deploy): add umami tracking, fix CSP, and lock JSON writes

privat/CV/andreknie.de/Caddyfile

@@ -1,5 +1,9 @@
-andreknie.de {
-	root * /opt/andreknie/site
+www.andreknie.de {
+	redir https://andreknie.de{uri}
+}
+
+localhost, andreknie.de {
+	root * /dist
 	encode zstd gzip
 
 	header {
@@ -8,10 +12,11 @@ andreknie.de {
 		X-Frame-Options "DENY"
 		Referrer-Policy "strict-origin-when-cross-origin"
 		Permissions-Policy "camera=(), geolocation=(), microphone=()"
+		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://stats.andreknie.de http://localhost:3000; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https://stats.andreknie.de http://localhost:3000"
 	}
 
 	handle /api/* {
-		reverse_proxy localhost:3003
+		reverse_proxy backend:3003
 	}
 
 	@assets path /assets/*
@@ -26,3 +31,7 @@ andreknie.de {
 		file_server
 	}
 }
+
+stats.andreknie.de {
+	reverse_proxy umami:3000
+}