Back to a link in the foreign embed, and scope the exemption to cross-site

Serve the app in the huggingface.co embed, not a link to it

Drop the COOP/COEP service worker — it fights the headers this Space sends

Give the local model back, and warn when the embed cannot isolate