docs: rename opencode.md to agents.md and refresh it (Forgejo, embed/SSRF notes)

agents.md

@@ -1,11 +1,11 @@
-# opencode.md — cold-boot notes
+# agents.md — cold-boot notes
 
 Quick context so a fresh session (no memory of this project) can be productive in
 a minute. Read this first, then skim the files it points at.
 
 ---
 
-## Keep README.md AND opencode.md in sync — do this on EVERY prompt
+## Keep README.md AND agents.md in sync — do this on EVERY prompt
 
 **Before you finish any task, update the docs so they still match the code.**
 This is a standing requirement, not a one-off, so treat it as part of "done":
@@ -15,10 +15,10 @@ a feature, script, route, app, theme, file or dependency, reflect it in `README.
 (Features, Tech Stack, API Routes, Project Structure, Scripts, running/deploying
 sections — whichever apply).
 
-**`opencode.md`** (this file) is the cold-boot doc for the next session. Update it in
+**`agents.md`** (this file) is the cold-boot doc for the next session. Update it in
 the same task whenever a change touches anything it describes — architecture, the key
 files and their invariants, conventions/gotchas, history, or testing notes. A stale
-`opencode.md` is worse than none: it actively misleads the next session.
+`agents.md` is worse than none: it actively misleads the next session.
 
 For both docs:
 - Re-read the doc and the files you touched; fix anything the change made stale.
@@ -27,7 +27,7 @@ For both docs:
 - If a task genuinely changes nothing that either doc describes, it's fine to leave
   that doc untouched — use judgement, don't churn it for nothing.
 
-When in doubt, prefer updating. A stale README **or** opencode.md is treated as a bug.
+When in doubt, prefer updating. A stale README **or** agents.md is treated as a bug.
 
 ---
 
@@ -56,9 +56,9 @@ Useful checks before handing work back: `npx tsc --noEmit`, `npx eslint <files>`
 `npm run build`.
 
 ### Git
-Branch is **main**. Remote is a self-hosted Gitea at
-`git.dvorakmortonxd.dev`. **The remote URL contains a plaintext access token.**
-Do not print it, copy it into new files, or push it anywhere else.
+Branch is **main**. Remote is a self-hosted **Forgejo** instance (the "GitDXD"
+app) at `git.dvorakmortonxd.dev`. **The remote URL contains a plaintext access
+token.** Do not print it, copy it into new files, or push it anywhere else.
 
 ---
 
@@ -305,13 +305,22 @@ list reordering, not free placement. Don't confuse the two.
   standalone script mirroring `normalize()` / `posToCell()` is a fast way to
   prove one-icon-per-cell holds for edge cases (offscreen drops, tiny
   viewports, repeated drops on one cell).
+- To verify a service iframe embed without a GUI browser: check the header with
+  `curl -sI <service>` (you want no `X-Frame-Options`, or a value a browser
+  doesn't recognise), then drive Playwright's cached Chromium
+  (`~/.cache/ms-playwright/chromium-*/chrome-linux64/chrome`) headlessly at a
+  small HTML page that iframes the service and `--screenshot` it. Its system
+  libs can be fetched without root via `apt-get download` + `dpkg-deb -x` into a
+  local dir and `LD_LIBRARY_PATH`. Frame the test from an `http(s)` origin (e.g.
+  a file dropped in `public/` served at `localhost:3000`); a `file://`
+  top-level blocks the iframe's storage and makes working sites look blank.
 
 ---
 
 ## After finishing — push to git
 
-First make sure `README.md` **and** `opencode.md` are up to date (see "Keep
-README.md AND opencode.md in sync" at the top), then run **only** these three
+First make sure `README.md` **and** `agents.md` are up to date (see "Keep
+README.md AND agents.md in sync" at the top), then run **only** these three
 commands (no extra flags, no rebasing, no force-push):
 
 ```bash