desktop: keep drag/resize working over embedded iframes + add embed loading spinner

agents.md

@@ -283,6 +283,16 @@ list reordering, not free placement. Don't confuse the two.
   `Content-Security-Policy: frame-ancestors`. Discord keeps a link card because
   it sends `DENY` and can't be configured. Always verify headers before enabling
   `embed` on a new service.
+- **Embedded iframes swallow the pointer.** While dragging/resizing a window,
+  the moment the cursor passes over a service `<iframe>` the site's own document
+  receives the `pointermove`/`pointerup`, so a gesture that listens on `window`
+  (see `WinWindow.tsx`) freezes mid-drag. `WinWindow` therefore flags the window
+  `interacting` for the duration of the gesture and CSS sets
+  `pointer-events: none` on `.website-embed-frame` until it ends. Keep that rule
+  if you add another gestural interaction that can pass over an embed.
+- `EmbeddedSite` (in `apps.tsx`) shows a spinner until the iframe fires `load`,
+  because Navidrome/Forgejo are SPAs that render blank for a moment while they
+  boot.
 - Reduced motion is handled with a near-zero `animation-duration` (not
   `animation: none`) so `animationend` still fires and windows unmount.