Fix: Allow asset.localhost in CSP for Windows drag-drop (#1298)

On Windows production builds, convertFileSrc() generates
https://asset.localhost/... URLs. The connect-src CSP only had "asset:"
(covering asset:// on macOS/Linux) but not https://asset.localhost,
causing the fetch() in GlobalFileDropHandler to be silently blocked —
overlay appeared but no modal opened on drop.

crates/desktop/artcraft/tauri-mac.conf.json

@@ -37,6 +37,7 @@
           "'unsafe-eval'",
           "'unsafe-inline'",
           "asset:",
+          "https://asset.localhost",
           "blob:",
           "data:",
           "http://ipc.localhost",

crates/desktop/artcraft/tauri.conf.json

@@ -7,12 +7,11 @@
     "frontendDist": "../../../frontend/apps/artcraft/dist",
     "devUrl": "http://localhost:5173",
     "beforeDevCommand": "nx run artcraft:dev",
-    "beforeBuildCommand": "nx run artcraft:build"
+    "beforeBuildCommand": "npx run artcraft:build"
   },
   "app": {
     "withGlobalTauri": true,
-    "windows": [
-    ],
+    "windows": [],
     "security": {
       "assetProtocol": {
         "enable": true,
@@ -37,6 +36,7 @@
           "'unsafe-eval'",
           "'unsafe-inline'",
           "asset:",
+          "https://asset.localhost",
           "blob:",
           "data:",
           "http://ipc.localhost",