Drop --server.enableCORS=false / enableXsrfProtection=false (was breaking iframe embed)

Dockerfile

@@ -25,11 +25,12 @@ EXPOSE 7860
 
 # Streamlit needs to listen on 0.0.0.0 inside the container so the Space's
 # reverse proxy can reach it. --server.headless avoids opening a browser
-# during launch (no display in a container).
+# during launch (no display in a container). We deliberately keep CORS and
+# XSRF protection at their Streamlit defaults — disabling both at once puts
+# Streamlit into a broken state where the websocket handshake never completes
+# and the page renders an empty <div id="root">.
 CMD ["streamlit", "run", "app.py", \
      "--server.port=7860", \
      "--server.address=0.0.0.0", \
      "--server.headless=true", \
-     "--server.enableCORS=false", \
-     "--server.enableXsrfProtection=false", \
      "--browser.gatherUsageStats=false"]