Fixed hardcoded workspace paths and disabled Streamlit CORS/XSRF for HF iframe support

Added root Dockerfile and start.sh for unified hosting