Ship file viewer, editor improvements, and private package releases

docs/GUIDE.md

@@ -948,7 +948,7 @@ security: {
 ```
 
 Defaults include a strict CSP (`default-src 'self'`, `script-src 'self'`, `style-src 'self'
-'unsafe-inline'`, `frame-ancestors 'none'`, …), `X-Frame-Options: DENY`, restrictive
+'unsafe-inline'`, `frame-ancestors 'self'`, …), `X-Frame-Options: SAMEORIGIN`, restrictive
 Permissions‑Policy, COOP `same-origin`, and Referrer‑Policy. Set any directive/section to `false`
 to remove it, or `security.headers = false` to disable all framework headers. WebSocket upgrades are
 guarded against cross‑site hijacking (same‑origin + configured CORS origins + non‑browser clients).
@@ -1342,7 +1342,7 @@ export default config;
 
 **CSP defaults:** `default-src 'self'`; `script-src 'self'`; `style-src 'self' 'unsafe-inline'`;
 `img-src 'self' data: blob:`; `font-src 'self' data:`; `connect-src 'self' ws: wss:`;
-`object-src 'none'`; `base-uri 'self'`; `frame-ancestors 'none'`; `form-action 'self'`. Set a
+`object-src 'none'`; `base-uri 'self'`; `frame-ancestors 'self'`; `form-action 'self'`. Set a
 directive to `false`/`null` to remove it.
 
 ## 33. Directive & attribute cheat sheet