fix(web): harden the app-origin paths and correct three docs

Copilot review round 1 on #2100.

- POST /api/app-document: `null` and `[1,2]` are valid JSON, so the
  destructure that followed threw OUTSIDE the parse try/catch and turned a
  malformed body into a 500 instead of the documented 400.
- app-origin controller: the error handler cleared `server` but not
  `origin`, and `publish` gates on `origin` — so an error after a successful
  listen kept minting URLs on a dead port and the browser never took the
  srcdoc fallback. Clear both, and drop the now-unfetchable documents.
- sandbox proxy: drop a stale `srcdoc` before navigating to a dedicated
  origin (srcdoc wins over src), and restore the opaque-origin posture —
  strip `allow-same-origin`, reset `innerOrigin` — before assigning `srcdoc`
  on the fallback path. Not reachable today (each render remounts the
  iframe), but the cost of being wrong about that later is an isolation
  boundary.
- publishAppDocument tests: replace two `as unknown as Response` casts with
  real `Response`s.
- docs: `frame-ancestors` admits the proxy AND the Inspector page (every
  ancestor is checked); the shared helper falls back to loopback, not
  `'none'`; the showcase origin is `127.0.0.1`, the default bind address.
- tests: null/array body, post-listen error, and both factories receiving a
  working `publishAppDocument`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/integration/mcp/remote/app-document-route.test.ts

@@ -84,6 +84,20 @@ describe("createRemoteApp POST /api/app-document", () => {
     expect(res.status).toBe(400);
   });
 
+  it.each([
+    ["a JSON null body", "null"],
+    ["a JSON array body", "[1,2]"],
+  ])("rejects %s with 400 rather than a 500", async (_label, raw) => {
+    // Both parse cleanly, so the try/catch above sees nothing — destructuring
+    // them is what used to throw, outside it, turning a bad shape into a 500.
+    const publish = vi
+      .fn<(doc: { html: string; csp?: string }) => { url: string } | null>()
+      .mockReturnValue({ url: "http://x/y" });
+    const res = await appWith(publish).request(post(raw));
+    expect(res.status).toBe(400);
+    expect(publish).not.toHaveBeenCalled();
+  });
+
   it.each([
     ["missing html", {}],
     ["empty html", { html: "" }],

clients/web/src/test/integration/server/app-origin-controller.test.ts

@@ -337,6 +337,58 @@ describe("createAppOriginController", () => {
     }
   });
 
+  it("stops minting URLs when the listener errors AFTER it bound", async () => {
+    // `publish` gates on `origin`, not on `server`. An error arriving once the
+    // listener is live must therefore clear `origin` too — otherwise the
+    // browser keeps being handed URLs on a dead port and never takes the
+    // srcdoc fallback the caller is promised.
+    vi.resetModules();
+    let emitter!: EventEmitter;
+    vi.doMock("node:http", async () => {
+      const actual =
+        await vi.importActual<typeof import("node:http")>("node:http");
+      return {
+        ...actual,
+        createServer: () => {
+          emitter = new EventEmitter();
+          return Object.assign(emitter, {
+            listen: (_p: number, _h: string, cb?: () => void) =>
+              setImmediate(() => cb?.()),
+            address: () => ({
+              address: "127.0.0.1",
+              family: "IPv4",
+              port: 6276,
+            }),
+            close: (cb?: () => void) => cb?.(),
+          });
+        },
+      };
+    });
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      const mod = await import("../../../../server/app-origin-controller.js");
+      const c = mod.createAppOriginController({
+        port: 6276,
+        host: "127.0.0.1",
+      });
+      await c.start();
+      expect(c.getOrigin()).toBe("http://127.0.0.1:6276");
+      expect(c.publish({ html: "<p>x</p>" })).not.toBeNull();
+
+      emitter.emit(
+        "error",
+        Object.assign(new Error("boom"), { code: "EPIPE" }),
+      );
+
+      expect(c.getOrigin()).toBeNull();
+      expect(c.publish({ html: "<p>x</p>" })).toBeNull();
+    } finally {
+      errorSpy.mockRestore();
+      vi.doUnmock("node:http");
+      vi.resetModules();
+    }
+  });
+
   it("gives up after one retry when the dynamic fallback also fails", async () => {
     // Guards the `retriedDynamic` latch. A real `listen(0)` effectively always
     // succeeds, so a claimed port only ever produces ONE EADDRINUSE — under