desktop: embed Navidrome again (needs ND_HTTPHEADERS_FRAMEOPTIONS on the Navidrome host)

opencode.md

@@ -270,13 +270,16 @@ list reordering, not free placement. Don't confuse the two.
 - Service shortcuts can show the real site in an iframe via
   `createWebsiteApp({ embed: true })` (the shortcut's `embed` flag), but the
   browser refuses to frame a site that sends `X-Frame-Options` /
-  `frame-ancestors`, leaving a blank window. `embed` is only set on Llama.cpp
-  (Open WebUI) and Jellyfin, which allow framing. Navidrome (`DENY`) and
-  Forgejo/GitDXD (`SAMEORIGIN`) are deliberately **not** embedded: Navidrome
-  falls back to the link card and GitDXD opens its dedicated app card. To embed
-  them live you must strip those headers at the edge (Cloudflare "Modify
-  Response Header" or nginx) and accept the clickjacking risk. Always verify
-  headers before enabling `embed` on a new service.
+  `frame-ancestors`, leaving a blank window. `embed` is set on Llama.cpp (Open
+  WebUI), Jellyfin and Navidrome. Llama.cpp/Jellyfin allow framing; Navidrome
+  only does when its host runs with `ND_HTTPHEADERS_FRAMEOPTIONS=ALLOWALL`
+  (Navidrome maps `HTTPHeaders.FrameOptions` to that env var and it overrides
+  its built-in `FrameDeny`; any unrecognised value is ignored by the browser).
+  For a scoped, clickjacking-safe alternative, remove the header at the edge
+  (Cloudflare "Modify Response Header" / nginx) and add
+  `Content-Security-Policy: frame-ancestors`. Forgejo/GitDXD (`SAMEORIGIN`)
+  keeps its dedicated app card. Always verify headers before enabling `embed`
+  on a new service.
 - Reduced motion is handled with a near-zero `animation-duration` (not
   `animation: none`) so `animationend` still fires and windows unmount.