chore(license): relicense artwork and move non-free media out (#3173)

fluxer_app_proxy/src/csp.rs

@@ -96,6 +96,7 @@ const FRAME_SOURCES: &[&str] = &[
 
 const IMAGE_SOURCES: &[&str] = &[
     "https://*.fluxer.app",
+    "https://fluxer.app",
     "https://i.ytimg.com",
     "https://*.youtube.com",
     "https://*.fluxer.media",
@@ -104,6 +105,7 @@ const IMAGE_SOURCES: &[&str] = &[
 
 const MEDIA_SOURCES: &[&str] = &[
     "https://*.fluxer.app",
+    "https://fluxer.app",
     "https://*.youtube.com",
     "https://*.fluxer.media",
     "https://fluxer.media",
@@ -434,6 +436,24 @@ mod tests {
         assert!(csp.contains("frame-ancestors 'none'"));
     }
 
+    #[test]
+    fn build_csp_allows_the_apex_domain_for_images_and_media() {
+        let config = default_csp_config();
+        let csp = build_csp(&config, &[hash_of("boot()")], &runtime_sources());
+        for name in ["img-src ", "media-src "] {
+            let directive = csp
+                .split("; ")
+                .find(|directive| directive.starts_with(name))
+                .expect("directive");
+            assert!(
+                directive
+                    .split(' ')
+                    .any(|source| source == "https://fluxer.app"),
+                "{name}must allow the apex domain: {directive}"
+            );
+        }
+    }
+
     #[test]
     fn build_csp_allows_blob_connections_for_camera_background_media() {
         let config = default_csp_config();

fluxer_app_proxy/src/routes/spa_index.rs

@@ -74,7 +74,6 @@ const STATIC_ASSET_PREFIXES: &[&str] = &[
     "/avatars/",
     "/badges/",
     "/desktop/",
-    "/embeds/",
     "/emoji/",
     "/libs/",
     "/marketing/",