fix(embed): make embed-mode framing opt-in

Embed-mode documents now keep the server's framing protection unless
GEV_EMBED_FRAME_ANCESTORS names the pages that may frame them (or * for any
page). The MCP Apps panel loads the app into its own page and needs no
framing. View answers are posted to the origin that sent the view rather
than to any origin.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/tooling/viteBuild.test.mjs

@@ -135,4 +135,11 @@ test('only embed-mode documents may be framed, and only by the allowed ancestors
     'x-frame-options': 'DENY',
     'content-security-policy': "frame-ancestors 'none'",
   });
+  // Unset, no page may frame even embed-mode documents.
+  for (const ancestors of ['', '   ']) {
+    const plugin = embedFramingPlugin({ ancestors });
+    assert.equal(plugin.name, 'embed-framing');
+    assert.equal(plugin.configureServer, undefined);
+    assert.equal(plugin.configurePreviewServer, undefined);
+  }
 });