Harden MkDocs header auth-check: targeted postMessage, tighter CSP

- Replace postMessage wildcard ('*') with explicit parent origin passed
  via ?origin= parameter to prevent auth state disclosure to arbitrary
  embedders
- Tighten frame-ancestors CSP: production restricts to self + DOMAIN,
  dev restricts to localhost origins (was frame-ancestors *)
- Remove deprecated X-Frame-Options ALLOW-FROM header (CSP
  frame-ancestors is the modern replacement)
- Validate targetOrigin with URL constructor before use

Bunker Admin

nginx/conf.d/default.conf.template

@@ -7,7 +7,7 @@ server {
 
     # Auth check iframe — allows cross-origin login state detection (MkDocs header)
     location = /auth-check.html {
-        add_header Content-Security-Policy "frame-ancestors *" always;
+        add_header Content-Security-Policy "frame-ancestors 'self' http://localhost:* http://127.0.0.1:*" always;
         set $upstream_admin_authcheck http://changemaker-v2-admin:3000;
         proxy_pass $upstream_admin_authcheck;
         proxy_set_header Host $host;

nginx/conf.d/services.conf.template

@@ -372,7 +372,6 @@ server {
     # Auth check iframe — allows root domain to embed this tiny page
     # for cross-origin login state detection (MkDocs header)
     location = /auth-check.html {
-        add_header X-Frame-Options "ALLOW-FROM https://${DOMAIN}" always;
         add_header Content-Security-Policy "frame-ancestors 'self' https://${DOMAIN} http://${DOMAIN}" always;
         set $upstream_admin_authcheck http://changemaker-v2-admin:3000;
         proxy_pass $upstream_admin_authcheck;