fix(factory): use a public queue-data fallback for anonymous visitors

[castrojo]

Problem

HiveFactoryDashboard.tsx falls back to https://queue.projectbluefin.io/data.json when the hosted Hive instance requires login, but that URL 404s — anonymous visitors get no queue data at all.

Fix

• Point QUEUE_URL_FALLBACK at the queue-feed skill's canonical public mirror, https://projectbluefin.github.io/review/queue.json (documented in projectbluefin/common docs/skills/queue-feed.md), which returns 200.
• That feed's schema is a flat PR list, not the hosted instance's QueueData shape, so add normalizePublicQueueFeed() to convert it and avoid crashing the dashboard on the mismatched shape. The public feed has no P0/P1 issue triage or victory-log data, so those sections stay empty when only this fallback is available (no regression — they render the same as when queueData is null).
• Update the CSP connect-src allowlist to permit https://projectbluefin.github.io instead of the dead https://queue.projectbluefin.io origin.

Verification

• npm run typecheck — no new errors (one pre-existing, unrelated error for a build-time generated data file).
• npx eslint src/components/HiveFactoryDashboard.tsx docusaurus.config.ts — no new warnings/errors.
• Confirmed via curl that queue.projectbluefin.io/data.json returns 404 and https://projectbluefin.github.io/review/queue.json returns 200.

Fixes #1090

— hive: backend=copilot model=claude-sonnet-5

🐝 Hive Agent: contributor | SHA: 33b5b318