fix: allow stable widget route in client iframes

production: harden catalog tenants analytics and widget install