Fix CSP frame-ancestors for Hugging Face Spaces

Allow the app to be framed by Hugging Face domains in production
to prevent CSP violations. This resolves the frame-ancestors
error in the browser console.

server/index.ts

@@ -53,6 +53,9 @@ app.use(helmet({
       styleSrc: ["'self'", "'unsafe-inline'"],
       imgSrc: ["'self'", "data:", "https:"],
       connectSrc: ["'self'", "https://api.studio.nebius.ai", "https://api.github.com"],
+      frameAncestors: process.env.NODE_ENV === 'production' 
+        ? ["'self'", "https://*.hf.space", "https://huggingface.co"] 
+        : ["'self'"], // Allow HF domains in production
     },
   },
 }));