embed friends' sites live in desktop windows; frame the skopec mirror since skopec.dev blocks framing

src/app/components/WindowsDesktop.tsx

@@ -27,6 +27,8 @@ interface Shortcut {
   image?: string;
   /** Show the real site in an iframe. Only for sites that allow framing. */
   embed?: boolean;
+  /** Frame src when it differs from `url` (e.g. a local mirror of a blocking site). */
+  embedUrl?: string;
 }
 
 interface IconEntry {
@@ -58,10 +60,18 @@ const SERVICE_SHORTCUTS: Shortcut[] = [
   { id: "svc-gitdxd", icon: "🐙", label: "GitDXD", url: "https://git.dvorakmortonxd.dev", color: "#6a4fb3", desc: "Best Git Hosting OAT", embed: true },
 ];
 
+// Friends' sites, opened in a live window when they allow framing. bukovinafilip
+// and vlcak.me send no framing headers, so `url` (== `realUrl`) is framed
+// directly. skopec.dev sends `X-Frame-Options: SAMEORIGIN` on every path, so we
+// frame the same-origin mirror at `/skopec.html` instead; the www button still
+// opens the live site. To embed a site that blocks framing live, it would need a
+// header-stripping proxy.
 const FRIEND_SHORTCUTS: Shortcut[] = friends.map((f, i) => ({
   id: `friend-${i}`,
   label: f.name,
   url: f.realUrl || f.url,
+  embedUrl: f.url,
+  embed: f.iframe,
   color: "#c0392b",
   icon: "🫂",
   image: f.img,
@@ -214,6 +224,7 @@ export default function WindowsDesktop() {
         icon: s.icon,
         image: s.image,
         embed: s.embed,
+        embedUrl: s.embedUrl,
       });
     setDynamicApps((prev) => (prev[id] ? prev : { ...prev, [id]: app }));
     openAppDef(app);