historical rates: point at frankfurter.dev, fetch on cold start too

api.frankfurter.app 301-redirects to frankfurter.dev now, and the old
host is flaky over reqwest/rustls-tls — talk to the new one directly
(Rust backend, the vite-dev web fallback, and the CSP allowlist).

Separately, a sheet reopened on boot with "on 2024-01-01" in it never
fetched historical rates at all: the fetch only ran from switchDoc()
and the editor's onChange, and the editor's initial text is seeded
directly, bypassing both.

src-tauri/src/main.rs

@@ -361,7 +361,9 @@ async fn fetch_historical_rates(
         .timeout(std::time::Duration::from_secs(15))
         .build()
         .map_err(|e| e.to_string())?;
-    let url = format!("https://api.frankfurter.app/{}?from=USD", date);
+    // api.frankfurter.app 301-redirects here now, and the old domain is
+    // flaky over reqwest/rustls-tls — go straight to the stable host
+    let url = format!("https://api.frankfurter.dev/v1/{}?from=USD", date);
     let body: serde_json::Value = client
         .get(&url)
         .send()

src-tauri/tauri.conf.json

@@ -23,7 +23,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src ipc: http://ipc.localhost https://open.er-api.com https://api.coingecko.com https://query1.finance.yahoo.com https://query2.finance.yahoo.com https://api.frankfurter.app"
+      "csp": "default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src ipc: http://ipc.localhost https://open.er-api.com https://api.coingecko.com https://query1.finance.yahoo.com https://query2.finance.yahoo.com https://api.frankfurter.dev"
     }
   },
   "bundle": {

src/main.ts

@@ -816,6 +816,9 @@ async function boot(): Promise<void> {
     (text) => workspace.evaluateSheet(activeDoc().id, text),
     data.contents[data.activeId] ?? "",
   );
+  // the editor above was seeded directly with initialText (not via switchDoc),
+  // so a reopened sheet with "on 2024-01-01" needs its own historical-rate fetch
+  void fetchNeededHistoricalRates(data.contents[data.activeId] ?? "");
 
   applySettings(); // sets the language before bindSettingsUI renders dynamic labels
   bindSettingsUI();

src/storage.ts

@@ -212,7 +212,7 @@ export async function fetchHistoricalRates(date: string): Promise<Record<string,
     if (isTauri()) {
       return await invoke<Record<string, number>>("fetch_historical_rates", { date });
     }
-    const res = await fetch(`https://api.frankfurter.app/${date}?from=USD`);
+    const res = await fetch(`https://api.frankfurter.dev/v1/${date}?from=USD`);
     const json = await res.json();
     if (!json?.rates) return null;
     const out: Record<string, number> = { USD: 1 };