Drop CSP frame-ancestors directive entirely

`frame-ancestors *` still rejects non-network parent schemes (data:,
blob:, chrome-extension:, chrome-error://) — so iframe embedding from
extensions, error pages, or sandboxed parents was still blocked.

Omitting the directive falls back to "no restriction" and there's no
X-Frame-Options set, so embedding works from any context. Safe because
relay credentials live in localStorage, not cookies — no clickjacking
auth surface.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Amos N.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopsy",
-  "version": "1.0.27",
+  "version": "1.0.28",
   "private": true,
   "description": "Control your terminal from your phone. Self-hosted on Cloudflare Workers.",
   "scripts": {

packages/relay/src/index.ts

@@ -29,17 +29,19 @@ import { LANDING_HTML } from './landing.js';
  * JetBrains Mono).
  */
 function buildCsp(host: string, nonce: string): string {
+  // Note: no `frame-ancestors`. Self-hosted relays are often mounted inside
+  // parent dashboards/portals, including non-network schemes (data:, blob:,
+  // chrome-extension:) where `frame-ancestors *` still blocks. Omitting the
+  // directive falls back to "no restriction" — and there's no X-Frame-Options
+  // set, so embedding works from any context. Safe because relay credentials
+  // live in localStorage (no cookies = no clickjacking auth surface).
   return [
     "default-src 'self'",
     `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net`,
     "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com",
     "font-src 'self' data: https://fonts.gstatic.com https://cdn.jsdelivr.net",
     `connect-src 'self' wss://${host} https://cdn.jsdelivr.net`,
     "img-src 'self' data:",
-    // Allow embedding in iframes on any origin. Self-hosted relays are often
-    // mounted inside parent dashboards/portals; the loopsy.dev deploy is also
-    // safe to embed because credentials live in localStorage (no cookies).
-    "frame-ancestors *",
     "base-uri 'self'",
     "form-action 'self'",
   ].join('; ');