fix: CSP blocking Google Fonts + missing org-applications assets

- .htaccess: allow fonts.googleapis.com in style-src and
  fonts.gstatic.com in font-src for IBM Plex Sans Arabic
- Add empty org-applications.css/js so module assets don't 404
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.htaccess

@@ -8,4 +8,4 @@ Header set X-Content-Type-Options "nosniff"
 Header set X-Frame-Options "DENY"
 Header set X-XSS-Protection "1; mode=block"
 Header set Referrer-Policy "strict-origin-when-cross-origin"
-Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'"
+Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com"

modules/org-applications/assets/org-applications.css

+/* org-applications module styles */

modules/org-applications/assets/org-applications.js

+// org-applications module scripts