390: Allow same-origin iframe embedding for admin previews

[turegjorup]

Closes #390.

Summary

The admin embeds the client via iframe to render screen/playlist previews and the fullscreen slide view. The nginx template was sending X-Frame-Options: DENY, so browsers refused to render the embedded iframe — exactly the failure shown in the issue's screenshot.

Fix

Two-header approach in infrastructure/nginx/etc/templates/default.conf.template:

add_header Content-Security-Policy "frame-ancestors 'self'" always;
add_header X-Frame-Options "SAMEORIGIN" always;

• Content-Security-Policy: frame-ancestors 'self' — the modern primary control. CSP Level 2+ is honored by every current browser and supersedes X-Frame-Options when both are present.
• X-Frame-Options: SAMEORIGIN — defense-in-depth for any pre-CSP-2 browser.

Both restrict iframe embedding to the same origin, which matches the docker-server compose layout where admin and client are served by the same nginx on the same hostname.

The Content-Security-Policy header here only sets frame-ancestors; it does not activate any other CSP rules and so doesn't risk breaking inline scripts or eval. Future CSP work can extend this header with additional directives without disturbing the iframe rule.

Local validation

Built the nginx image from this branch and confirmed both headers are present in the rendered config:

$ docker run --rm --entrypoint sh local/display-api-service-nginx:390-test \
    -c '/docker-entrypoint.sh nginx -V >/dev/null 2>&1; grep -E "frame-ancestors|X-Frame-Options" /etc/nginx/conf.d/default.conf'
    add_header Content-Security-Policy "frame-ancestors 'self'" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

Test plan

• Rebuild nginx image; deploy or run locally.
• Open admin → screen detail → confirm preview iframe renders without "refused to display in a frame" browser console error.
• Open admin → playlist preview → same check.
• Open a slide → fullscreen view → same check.
• curl -I against any page response shows both Content-Security-Policy: frame-ancestors 'self' and X-Frame-Options: SAMEORIGIN.

🤖 Generated with Claude Code