desktop: don't embed Navidrome/GitDXD (servers send X-Frame-Options, so the windows were blank)

opencode.md

@@ -267,14 +267,16 @@ list reordering, not free placement. Don't confuse the two.
   redirects. **Adding a service or friend host means adding it to
   `ALLOWED_HOSTS` in `api/ping/route.ts`**, otherwise its status dot reads
   "Dead". Do not turn this route back into an open fetch proxy.
-- Service shortcuts show the real site in an iframe via
-  `createWebsiteApp({ embed: true })` (the shortcut's `embed` flag). It only
-  works for sites that don't send `X-Frame-Options` / a `frame-ancestors` CSP.
-  `embed` is set on Llama.cpp (Open WebUI), Jellyfin, Navidrome and GitDXD; SMP
-  (Discord) is excluded because Discord sends `DENY`. Navidrome (`DENY`) and
-  GitDXD (`SAMEORIGIN`) still need those headers stripped at the edge (a
-  Cloudflare "Modify Response Header" rule or nginx) before their frames render.
-  Always verify headers before enabling `embed` on a new service.
+- Service shortcuts can show the real site in an iframe via
+  `createWebsiteApp({ embed: true })` (the shortcut's `embed` flag), but the
+  browser refuses to frame a site that sends `X-Frame-Options` /
+  `frame-ancestors`, leaving a blank window. `embed` is only set on Llama.cpp
+  (Open WebUI) and Jellyfin, which allow framing. Navidrome (`DENY`) and
+  Forgejo/GitDXD (`SAMEORIGIN`) are deliberately **not** embedded: Navidrome
+  falls back to the link card and GitDXD opens its dedicated app card. To embed
+  them live you must strip those headers at the edge (Cloudflare "Modify
+  Response Header" or nginx) and accept the clickjacking risk. Always verify
+  headers before enabling `embed` on a new service.
 - Reduced motion is handled with a near-zero `animation-duration` (not
   `animation: none`) so `animationend` still fires and windows unmount.