Fix blank dev window by relaxing CSP for HMR

The global webRequest.onHeadersReceived CSP rewrite was attached to
session.defaultSession, which intercepts every Chromium request
(including devtools and network service internals) and crashed the
network service in dev. Drop the global override and rely on the
renderer-level meta tag, widened to allow Vite's localhost HMR
connections.

AgentCompany-New/src/main/index.ts

@@ -1,4 +1,4 @@
-import { app, session } from "electron";
+import { app } from "electron";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DatabaseConnection } from "./database/connection";
@@ -13,22 +13,6 @@ if (!hasSingleInstanceLock) {
 }
 
 app.whenReady().then(() => {
-  session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
-    callback({
-      responseHeaders: {
-        ...details.responseHeaders,
-        "Content-Security-Policy": [
-          "default-src 'self'",
-          "script-src 'self'",
-          "style-src 'self' 'unsafe-inline'",
-          "img-src 'self' data:",
-          "connect-src 'self' http://localhost:* ws://localhost:*",
-          "font-src 'self' data:",
-        ].join("; "),
-      },
-    });
-  });
-
   const profileDir = process.env.AGENTCOMPANY_NEW_PROFILE_DIR ?? join(app.getPath("userData"), "profile");
   const connection = new DatabaseConnection(join(profileDir, "agentcompany.db"));
   const win = createMainWindow({

AgentCompany-New/src/renderer/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:;"
+      content="default-src 'self' 'unsafe-inline' http://localhost:* ws://localhost:* data:; img-src 'self' data:; font-src 'self' data:;"
     />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>AgentCompany</title>