What this PR does

This PR implements security hardening and bumps the application version to v3.0.6.

Key Changes:

• Strict Content Security Policy (CSP): Added a robust CSP to tauri.conf.json that isolates the frontend from the open internet. This ensures that even in the event of an XSS vulnerability, sensitive data like API keys cannot be exfiltrated to unauthorized domains.
• Version Bump: Updated version to 3.0.6 across package.json, Cargo.toml, and CHANGELOG.md.

How to test

1. Run npm run dev and ensure the application launches correctly.
2. Check the browser console to ensure no unexpected CSP violations are blocking core functionality (Tauri IPC and local assets should be allowed).
3. Verify that the UI still communicates with the Python sidecar and that translations work as expected.

Checklist

• Branch targets develop (not main)
• Branch name follows the naming convention (see CONTRIBUTING.md)
• Read CLAUDE.md before making changes
• Behaviour is unchanged or the change is intentional and described above
• Key behaviours are not broken: TTS feedback flag, VAD pre-buffer, WASAPI reinit, device fallback
• Glass design rules followed (no solid backgrounds, no Tailwind)
• No hardcoded API keys, paths, or credentials
• Tested manually with npm run dev