desktop: embed GitDXD too (Forgejo needs [cors] X_FRAME_OPTIONS = unset)

opencode.md

@@ -271,15 +271,18 @@ list reordering, not free placement. Don't confuse the two.
   `createWebsiteApp({ embed: true })` (the shortcut's `embed` flag), but the
   browser refuses to frame a site that sends `X-Frame-Options` /
   `frame-ancestors`, leaving a blank window. `embed` is set on Llama.cpp (Open
-  WebUI), Jellyfin and Navidrome. Llama.cpp/Jellyfin allow framing; Navidrome
-  only does when its host runs with `ND_HTTPHEADERS_FRAMEOPTIONS=ALLOWALL`
-  (Navidrome maps `HTTPHeaders.FrameOptions` to that env var and it overrides
-  its built-in `FrameDeny`; any unrecognised value is ignored by the browser).
-  For a scoped, clickjacking-safe alternative, remove the header at the edge
-  (Cloudflare "Modify Response Header" / nginx) and add
-  `Content-Security-Policy: frame-ancestors`. Forgejo/GitDXD (`SAMEORIGIN`)
-  keeps its dedicated app card. Always verify headers before enabling `embed`
-  on a new service.
+  WebUI), Jellyfin, Navidrome and GitDXD. Llama.cpp/Jellyfin allow framing out
+  of the box; the other two need their host configured so the header is an
+  unrecognised value (browsers ignore unknown X-Frame-Options values):
+  Navidrome via `ND_HTTPHEADERS_FRAMEOPTIONS=ALLOWALL` (it maps
+  `HTTPHeaders.FrameOptions` to that env var and it overrides the built-in
+  `FrameDeny`), and Forgejo via `[cors] X_FRAME_OPTIONS = unset` (Forgejo reads
+  this from the `[cors]` section, **not** `[security]`) followed by a Forgejo
+  restart. For a scoped, clickjacking-safe alternative, remove the header at the
+  edge (Cloudflare "Modify Response Header" / nginx) and add
+  `Content-Security-Policy: frame-ancestors`. Discord keeps a link card because
+  it sends `DENY` and can't be configured. Always verify headers before enabling
+  `embed` on a new service.
 - Reduced motion is handled with a near-zero `animation-duration` (not
   `animation: none`) so `animationend` still fires and windows unmount.