Content Security Policy error when status page url is configured

Reproduction steps

Default self-host install via install.sh script
Go to /admin dashboard
On Instance Configuration enter your status page url from your chosen provider
Open self-hosted instance via web or Fluxer Desktop App
Reload page with console open

Expected behaviour

Url should not be blocked by CSP

Actual behaviour

CORS policy causes the following error to show on console. This bug is on the official fluxer instance as well.

Build information

Canary Desktop 2026.1015.145307, Web 2026.1016.10903, Linux 7.2.10-1-cachyos (x64), Electron 44.4.1, Chrome 152.0.7977.78, Node 24.21.0, Locale en-US

Platform

Linux, Web, Self-hosting

Evidence

Access to fetch at 'https://status.example.com/summary.json' from origin 'fluxer-app://app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.