fix(csp): allow X (Twitter) conversion pixel domains on hosted (#5804)

apps/sim/lib/core/security/csp.ts

@@ -66,6 +66,9 @@ const STATIC_SCRIPT_SRC = [
         'https://*.hs-analytics.net',
         'https://*.hscollectedforms.net',
         'https://*.hs-banner.com',
+        // X (Twitter) conversion pixel (landing pages) — the base code injects
+        // uwt.js as a <script> tag from static.ads-twitter.com
+        'https://static.ads-twitter.com',
       ]
     : []),
 ] as const
@@ -106,6 +109,10 @@ const STATIC_CONNECT_SRC = [
         // The visitor beacon itself is an image pixel (img-src, already
         // permitted below), not a connect-src request.
         'https://*.hscollectedforms.net',
+        // X (Twitter) conversion pixel — uwt.js sends conversion beacons here
+        // via fetch/sendBeacon. The t.co image-pixel fallback is already
+        // covered by the `https:` wildcard in img-src.
+        'https://analytics.twitter.com',
       ]
     : []),
 ] as const