Re-enable XSRF off (needed for HF Spaces iframe websocket)

Dockerfile

@@ -29,8 +29,13 @@ EXPOSE 7860
 # XSRF protection at their Streamlit defaults — disabling both at once puts
 # Streamlit into a broken state where the websocket handshake never completes
 # and the page renders an empty <div id="root">.
+# XSRF protection must be off so that Streamlit accepts websocket frames
+# from a parent iframe at a different origin (huggingface.co). Keep CORS
+# enabled — turning *both* off puts Streamlit into a degraded state where
+# it never finishes the websocket handshake.
 CMD ["streamlit", "run", "app.py", \
      "--server.port=7860", \
      "--server.address=0.0.0.0", \
      "--server.headless=true", \
+     "--server.enableXsrfProtection=false", \
      "--browser.gatherUsageStats=false"]