Harden MkDocs header auth-check: targeted postMessage, tighter CSP

- Replace postMessage wildcard ('*') with explicit parent origin passed
  via ?origin= parameter to prevent auth state disclosure to arbitrary
  embedders
- Tighten frame-ancestors CSP: production restricts to self + DOMAIN,
  dev restricts to localhost origins (was frame-ancestors *)
- Remove deprecated X-Frame-Options ALLOW-FROM header (CSP
  frame-ancestors is the modern replacement)
- Validate targetOrigin with URL constructor before use

Bunker Admin

api/src/modules/docs/header-builder.service.ts

@@ -716,7 +716,7 @@ class HeaderBuilderService {
   // 2. Cross-origin check via hidden iframe + postMessage
   var iframe = document.createElement('iframe');
   iframe.style.display = 'none';
-  iframe.src = base + '/auth-check.html';
+  iframe.src = base + '/auth-check.html?origin=' + encodeURIComponent(location.origin);
   window.addEventListener('message', function(event) {
     if (event.origin !== base) return;
     if (event.data && event.data.type === 'cml-auth-status' && event.data.authenticated) {