fix: revert to document.body for toast — window.top blocked cross-origin

When the Space runs embedded on huggingface.co, window.top is the HF
parent page (different origin), so accessing window.top.document throws
a SecurityError. The _GLOBAL_JS already runs in the Space's own iframe
context so plain document.body is correct and always accessible.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app.py

@@ -2130,10 +2130,7 @@ _GLOBAL_JS = """
 
   // Toast notification — styled like ZeroGPU quota warnings.
   function _showRegenToast(message, isError) {
-    // Use window.top.document so the toast always lands on the visible page,
-    // regardless of whether this JS runs inside a Gradio shadow context.
-    var doc = (window.top && window.top.document) ? window.top.document : document;
-    var t = doc.createElement('div');
+    var t = document.createElement('div');
     t.style.cssText = 'position:fixed;bottom:24px;left:50%;transform:translateX(-50%);' +
       'z-index:2147483647;padding:12px 20px;border-radius:8px;font-family:sans-serif;' +
       'font-size:13px;max-width:520px;text-align:center;box-shadow:0 4px 20px rgba(0,0,0,.6);' +
@@ -2141,7 +2138,7 @@ _GLOBAL_JS = """
       'border:1px solid ' + (isError ? '#c0392b' : '#27ae60') + ';' +
       'pointer-events:none;';
     t.textContent = message;
-    doc.body.appendChild(t);
+    document.body.appendChild(t);
     setTimeout(function() {
       t.style.transition = 'opacity 0.5s';
       t.style.opacity = '0';