fix(web): harden the app-origin paths and correct three docs

Copilot review round 1 on #2100.

- POST /api/app-document: `null` and `[1,2]` are valid JSON, so the
  destructure that followed threw OUTSIDE the parse try/catch and turned a
  malformed body into a 500 instead of the documented 400.
- app-origin controller: the error handler cleared `server` but not
  `origin`, and `publish` gates on `origin` — so an error after a successful
  listen kept minting URLs on a dead port and the browser never took the
  srcdoc fallback. Clear both, and drop the now-unfetchable documents.
- sandbox proxy: drop a stale `srcdoc` before navigating to a dedicated
  origin (srcdoc wins over src), and restore the opaque-origin posture —
  strip `allow-same-origin`, reset `innerOrigin` — before assigning `srcdoc`
  on the fallback path. Not reachable today (each render remounts the
  iframe), but the cost of being wrong about that later is an isolation
  boundary.
- publishAppDocument tests: replace two `as unknown as Response` casts with
  real `Response`s.
- docs: `frame-ancestors` admits the proxy AND the Inspector page (every
  ancestor is checked); the shared helper falls back to loopback, not
  `'none'`; the showcase origin is `127.0.0.1`, the default bind address.
- tests: null/array body, post-listen error, and both factories receiving a
  working `publishAppDocument`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/remote/node/server.ts

@@ -749,13 +749,24 @@ export function createRemoteApp(
     if (!publish) {
       return c.json({ error: "App-origin hosting is not available" }, 503);
     }
-    let body: { html?: unknown; csp?: unknown };
+    let parsed: unknown;
     try {
-      body = (await c.req.json()) as { html?: unknown; csp?: unknown };
+      parsed = await c.req.json();
     } catch {
       return c.json({ error: "Invalid JSON body" }, 400);
     }
-    const { html, csp } = body;
+    // `null` and `[1,2]` are both valid JSON, so `c.req.json()` resolving is
+    // not proof there is an object to destructure — and destructuring `null`
+    // here would throw OUTSIDE the try above, turning a malformed body into a
+    // 500 instead of the 400 every other bad shape gets.
+    if (
+      parsed === null ||
+      typeof parsed !== "object" ||
+      Array.isArray(parsed)
+    ) {
+      return c.json({ error: "Invalid JSON body" }, 400);
+    }
+    const { html, csp } = parsed as { html?: unknown; csp?: unknown };
     if (typeof html !== "string" || html === "") {
       return c.json({ error: "Missing html" }, 400);
     }