cookiebanner: broaden resource detection via PerformanceObserver

ThirdPartyDetector previously only saw <script src> and <iframe src>
because it scanned the DOM and watched mutations. Add a single
PerformanceObserver({type:'resource', buffered:true}) that picks up
everything the browser actually loaded:

  - tracking pixels (<img>, <picture>, srcset)
  - cross-origin stylesheets and web fonts
  - fetch / XHR / sendBeacon / ping calls (SDK call-homes)
  - video, audio, embed, object media

initiatorType is mapped to six new tracker_resource_type enum values
(IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA) and the existing
upsert path in tracker_resources picks them up unchanged.

Closes a real gap with headless cookie scanners: most SDKs phone home
via beacons after their script is gone, and the DOM scan never saw it.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/console/v1/graphql/cookie_banner.graphql

@@ -308,6 +308,30 @@ enum TrackerResourceType
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeIframe"
         )
+    IMAGE
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeImage"
+        )
+    STYLESHEET
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeStylesheet"
+        )
+    FONT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeFont"
+        )
+    BEACON
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeBeacon"
+        )
+    FETCH
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeFetch"
+        )
+    MEDIA
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeMedia"
+        )
 }
 
 enum TrackerResourceOrderField

pkg/server/api/cookiebanner/v1/handler.go

@@ -445,6 +445,18 @@ func (h *Handler) handleReportDetectedTrackers(w http.ResponseWriter, r *http.Re
 			resourceType = coredata.TrackerResourceTypeScript
 		case "iframe":
 			resourceType = coredata.TrackerResourceTypeIframe
+		case "image":
+			resourceType = coredata.TrackerResourceTypeImage
+		case "stylesheet":
+			resourceType = coredata.TrackerResourceTypeStylesheet
+		case "font":
+			resourceType = coredata.TrackerResourceTypeFont
+		case "beacon":
+			resourceType = coredata.TrackerResourceTypeBeacon
+		case "fetch":
+			resourceType = coredata.TrackerResourceTypeFetch
+		case "media":
+			resourceType = coredata.TrackerResourceTypeMedia
 		default:
 			continue
 		}

pkg/server/api/mcp/v1/specification.yaml

@@ -9522,7 +9522,7 @@ components:
           description: Cookie category ID
         resource_type:
           type: string
-          enum: [SCRIPT, IFRAME]
+          enum: [SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA]
           description: Type of tracked resource
         origin:
           type: string
@@ -10186,7 +10186,7 @@ components:
           $ref: "#/components/schemas/GID"
         resource_type:
           type: string
-          enum: [SCRIPT, IFRAME]
+          enum: [SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA]
         origin:
           type: string
         path: