embed Navidrome and GitDXD service windows (pending edge X-Frame-Options removal)

README.md

@@ -33,9 +33,10 @@ heatmap**, a gym SBD panel and links to friends' sites.
   hidden `ssh` easter egg.
 - **Live service status** — each self-hosted service is health-checked through the site's
   own API; Minecraft is checked through mcstatus.io.
-- **Embedded live services** — opening Llama.cpp or Jellyfin from the desktop shows the
-  real site inside the window (an iframe). Services that forbid framing
-  (`X-Frame-Options` / CSP) keep a link card instead.
+- **Embedded live services** — opening a self-hosted service (Llama.cpp/Open WebUI,
+  Jellyfin, Navidrome, GitDXD) from the desktop shows the real site inside the window (an
+  iframe). The service must allow framing; SMP (Discord) keeps a link card because Discord
+  sends `X-Frame-Options: DENY`.
 - **Live GitDXD stats** — contribution heatmap + latest commit activity proxied server-side
   from the self-hosted Forgejo instance.
 - **Extras** — a playable `Revival Inc.` game embedded at `/revival-inc`, `llms.txt`,

opencode.md

@@ -211,12 +211,14 @@ list reordering, not free placement. Don't confuse the two.
   `eslint-disable-next-line` with a comment. Don't add more without a reason.
 - Watch for `pointercancel`: any custom pointer gesture over an `<img>`, link,
   or text selection needs `draggable=false` / `user-select: none`.
-- Service shortcuts can show the real site in an iframe via
-  `createWebsiteApp({ embed: true })` (set on the shortcut's `embed` flag), but
-  **only for sites that don't send `X-Frame-Options` / a `frame-ancestors` CSP**.
-  As of writing only **Llama.cpp** and **Jellyfin** qualify; Navidrome
-  (`DENY`), GitDXD (`SAMEORIGIN`) and SMP/Discord (`DENY`) block framing and
-  keep the link card. Verify headers before enabling `embed` on a new service.
+- Service shortcuts show the real site in an iframe via
+  `createWebsiteApp({ embed: true })` (the shortcut's `embed` flag). It only
+  works for sites that don't send `X-Frame-Options` / a `frame-ancestors` CSP.
+  `embed` is set on Llama.cpp (Open WebUI), Jellyfin, Navidrome and GitDXD; SMP
+  (Discord) is excluded because Discord sends `DENY`. Navidrome (`DENY`) and
+  GitDXD (`SAMEORIGIN`) still need those headers stripped at the edge (a
+  Cloudflare "Modify Response Header" rule or nginx) before their frames render.
+  Always verify headers before enabling `embed` on a new service.
 - Reduced motion is handled with a near-zero `animation-duration` (not
   `animation: none`) so `animationend` still fires and windows unmount.
 

src/app/components/WindowsDesktop.tsx

@@ -41,8 +41,8 @@ const SERVICE_SHORTCUTS: Shortcut[] = [
   { id: "svc-ai", icon: "🦾", label: "Llama.cpp", url: "https://ai.dvorakmortonxd.dev/", color: "#157347", desc: "Local AI Server", embed: true },
   { id: "svc-jellyfin", icon: "🎬", label: "Jellyfin", url: "https://jelly.dvorakmortonxd.dev/", color: "#6a4fb3", desc: "Local Media Server", embed: true },
   { id: "svc-smp", icon: "🎮", label: "SMP", url: "https://discord.gg/vyvhk7d8bX", color: "#c0392b", desc: "My Survival Minecraft Server" },
-  { id: "svc-navidrome", icon: "🎸", label: "Navidrome", url: "https://navidrome.dvorakmortonxd.dev/", color: "#b3005f", desc: "Music Streaming" },
-  { id: "svc-gitdxd", icon: "🐙", label: "GitDXD", url: "https://git.dvorakmortonxd.dev", color: "#6a4fb3", desc: "Best Git Hosting OAT" },
+  { id: "svc-navidrome", icon: "🎸", label: "Navidrome", url: "https://navidrome.dvorakmortonxd.dev/", color: "#b3005f", desc: "Music Streaming", embed: true },
+  { id: "svc-gitdxd", icon: "🐙", label: "GitDXD", url: "https://git.dvorakmortonxd.dev", color: "#6a4fb3", desc: "Best Git Hosting OAT", embed: true },
 ];
 
 const FRIEND_SHORTCUTS: Shortcut[] = friends.map((f, i) => ({