Set EMBED_ORIGINS for HF iframe

Dockerfile

@@ -35,6 +35,8 @@ RUN npm run build
 # Runtime-writable dirs for project/media storage (ephemeral on HF — resets on Space restart).
 RUN mkdir -p public/projects public/uploads .preview-data
 
-ENV NODE_ENV=production
+# Allow Hugging Face to embed the app in its Spaces iframe (frame-ancestors instead of X-Frame-Options).
+ENV NODE_ENV=production \
+    EMBED_ORIGINS="https://huggingface.co https://*.hf.space"
 EXPOSE 7860
 CMD ["node", "server/index.mjs"]