docs: iframe data-lake bridge is undocumented

An iframe widget can subscribe to data-lake variables over `postMessage` (`cockpit:listenToDatalakeVariables` / `cockpit:datalakeVariable`), and there is a `CockpitAPI` browser bundle for it. The user docs never mention that bridge. They also never say it is listen-only — a child page can read telemetry and has no documented way to write back.

Reproduce: open https://blueos.cloud/cockpit/docs/latest/usage/advanced/ and the IFrame section. It describes embedding another HTML page (cameras, BlueOS extensions). No `CockpitAPI`, no `postMessage`, no listen-only warning. `src/libs/external-api/api.ts` is the client; `apiEventCallback` in `src/components/widgets/IFrame.vue` is the parent and only handles `cockpit:listenToDatalakeVariables`. `maxRateHz` is sent by the client and ignored by the parent.

Open the IFrame section at src/../cockpit/docs/latest/usage/advanced/ and read the existing embedding guidance first. Then inspect src/libs/external-api/api.ts and apiEventCallback in src/components/widgets/IFrame.vue to document the postMessage bridge, its listen-only behavior, and the maxRateHz handling shown by the payload. Done means the user docs mention CockpitAPI, both message names, and the read-only limitation.

Written by the indexing model from the issue text.