Try out the demo UI example failed due to Content Security Policy violation error

### What happened?

When started the demo UI, I want to say "Hi" to the demo agent, however, it stuck on there:

### Relevant log output

```shell
On the backend side, I've started the service by running `uv run main.py` and could see some errors when try to say "hi" to the demo agent:

INFO: 127.0.0.1:53989 - "POST /__ui__ HTTP/1.1" 200 OK
INFO: 127.0.0.1:54501 - "POST /message/list HTTP/1.1" 200 OK
INFO: 127.0.0.1:54503 - "POST /conversation/list HTTP/1.1" 200 OK
INFO: 127.0.0.1:54505 - "POST /task/list HTTP/1.1" 200 OK
INFO: 127.0.0.1:54507 - "POST /message/pending HTTP/1.1" 200 OK
INFO: 127.0.0.1:53989 - "GET /conversation?conversation_id=cac93e08-49b6-4d96-b156-04ae2e1d8180 HTTP/1.1" 200 OK
INFO: 127.0.0.1:53989 - "GET /styles.css HTTP/1.1" 200 OK
INFO: 127.0.0.1:54512 - "GET /prod_bundle.js HTTP/1.1" 200 OK
INFO: 127.0.0.1:54513 - "GET /zone.js/bundles/zone.umd.js HTTP/1.1" 200 OK
[2025-09-22 15:09:30,360] ERROR in app: Exception on /.well-known/appspecific/com.chrome.devtools.json [GET]
Traceback (most recent call last):
File "/Users/user/Projects/OpenSource/github.com/a2aproject/a2a-samples/.venv/lib/python3.13/site-packages/flask/app.py", line 1511, in wsgi_app
response = self.full_dispatch_request()
File "/Users/user/Projects/OpenSource/github.com/a2aproject/a2a-samples/.venv/lib/python3.13/site-packages/flask/app.py", line 919, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/Users/user/Projects/OpenSource/github.com/a2aproject/a2a-samples/.venv/lib/python3.13/site-packages/flask/app.py", line 917, in full_dispatch_request
rv = self.dispatch_request()
File "/Users/user/Projects/OpenSource/github.com/a2aproject/a2a-samples/.venv/lib/python3.13/site-packages/flask/app.py", line 902, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args) # type: ignore[no-any-return]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
File "/Users/user/Projects/OpenSource/github.com/a2aproject/a2a-samples/.venv/lib/python3.13/site-packages/mesop/server/static_file_serving.py", line 166, in serve_file
return send_file_compressed(
get_path(path),
disable_gzip_cache=disable_gzip_cache,
)
File "/Users/user/Projects/OpenSource/github.com/a2aproject/a2a-samples/.venv/lib/python3.13/site-packages/mesop/server/static_file_serving.py", line 396, in send_file_compressed
response = send_file(path)
File "/Users/user/Projects/OpenSource/github.com/a2aproject/a2a-samples/.venv/lib/python3.13/site-packages/flask/helpers.py", line 518, in send_file
return werkzeug.utils.send_file( # type: ignore[return-value]
~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
**_prepare_send_file_kwargs(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...<9 lines>...
)
^
)
^
File "/Users/user/Projects/OpenSource/github.com/a2aproject/a2a-samples/.venv/lib/python3.13/site-packages/werkzeug/utils.py", line 428, in send_file
stat = os.stat(path)
FileNotFoundError: [Errno 2] No such file or directory: '/Users/user/Projects/OpenSource/github.com/a2aproject/a2a-samples/.venv/lib/python3.13/site-packages/mesop/utils/../web/src/app/prod/web_package/.well-known/appspecific/com.chrome.devtools.json'
INFO: 127.0.0.1:54514 - "GET /.well-known/appspecific/com.chrome.devtools.json HTTP/1.1" 500 Internal Server Error
INFO: 127.0.0.1:54513 - "GET /prod_bundle_app_bundle.min.js.map HTTP/1.1" 200 OK
INFO: 127.0.0.1:54513 - "POST /__ui__ HTTP/1.1" 200 OK
INFO: 127.0.0.1:54512 - "GET /favicon.ico HTTP/1.1" 200 OK
INFO: 127.0.0.1:54513 - "GET /__web-components-module__/components/async_poller.js HTTP/1.1" 200 OK

⚠️ Content Security Policy Error ⚠️
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Directive: connect-src
Blocked URL: https://cdn.jsdelivr.net/gh/lit/dist@3/core/lit-core.min.js.map
App path: /conversation

ℹ️ If this is coming from your web component,
update your security policy like this:

@me.page(
security_policy=me.SecurityPolicy(
allowed_connect_srcs=[
'https://cdn.jsdelivr.net',
]
)
)

For more info:
https://mesop-dev.github.io/mesop/web-components/troubleshooting/
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

INFO: 127.0.0.1:54513 - "POST /__csp__ HTTP/1.1" 204 No Content
INFO: 127.0.0.1:54513 - "POST /__ui__ HTTP/1.1" 200 OK
INFO: 127.0.0.1:54524 - "POST /message/list HTTP/1.1" 200 OK
INFO: 127.0.0.1:54526 - "POST /conversation/list HTTP/1.1" 200 OK
INFO: 127.0.0.1:54528 - "POST /task/list HTTP/1.1" 200 OK
```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

The error shows a Content Security Policy violation blocking a script from cdn.jsdelivr.net and a missing file error for a Chrome devtools JSON. Look at the demo UI code to find where the security policy is set, likely in a page decorator. The fix involves adding 'https://cdn.jsdelivr.net' to allowed_connect_srcs. Also, check why the .well-known file is missing; it might be a packaging issue. Run the demo again after changes to see if the CSP error is resolved and the UI works.

由索引模型根据 Issue 内容生成。