embed live service sites (Llama.cpp, Jellyfin) inside desktop windows

opencode.md

@@ -83,6 +83,7 @@ src/app/
     MobileHome.tsx      → "skeuo" theme, phone: app grid + dock
     WinWindow.tsx       → a single draggable/resizable window
     apps.tsx            → APPS registry + the content of each app + in-app terminal
+                          + embedded-site windows
     useDesktopIcons.ts  → desktop icon grid + drag/drop  (THE KEY FILE, see below)
     useDragOrder.ts     → simple list reordering (mobile home screen only)
     useTheme.ts         → theme state via useSyncExternalStore
@@ -210,6 +211,12 @@ list reordering, not free placement. Don't confuse the two.
   `eslint-disable-next-line` with a comment. Don't add more without a reason.
 - Watch for `pointercancel`: any custom pointer gesture over an `<img>`, link,
   or text selection needs `draggable=false` / `user-select: none`.
+- Service shortcuts can show the real site in an iframe via
+  `createWebsiteApp({ embed: true })` (set on the shortcut's `embed` flag), but
+  **only for sites that don't send `X-Frame-Options` / a `frame-ancestors` CSP**.
+  As of writing only **Llama.cpp** and **Jellyfin** qualify; Navidrome
+  (`DENY`), GitDXD (`SAMEORIGIN`) and SMP/Discord (`DENY`) block framing and
+  keep the link card. Verify headers before enabling `embed` on a new service.
 - Reduced motion is handled with a near-zero `animation-duration` (not
   `animation: none`) so `animationend` still fires and windows unmount.