Realtime behind CSP

Supabase Realtime WebSockets are now allowed by the Content Security Policy, and the nav icon got headphones.