Bunch more stability fixes

nginx/conf.d/services.conf.template

@@ -73,14 +73,14 @@ server {
     }
 }
 
-# Listmonk
+# Listmonk — via auth proxy, allows iframe embedding from admin
 server {
     listen 80;
     server_name listmonk.${DOMAIN};
-    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.${DOMAIN}" always;
 
     location / {
-        set $upstream_listmonk http://listmonk-app:9000;
+        set $upstream_listmonk http://changemaker-v2-api:9002;
         proxy_pass $upstream_listmonk;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;