Allow status pages to be embedded in an iframe from configured origins

**Is your feature request related to a problem? Please describe.**

Public status pages are served with `Content-Security-Policy: frame-ancestors 'self'` (helmet's default). Embedding a status page in an iframe from another origin, for example an internal operations dashboard, is blocked by the browser. Serving the page on a custom domain does not help, because the embedding page is still a different origin. We currently run a local patch that hard-codes our origins into the global helmet `frame-ancestors` list, which is not something we can contribute as it stands.

**Describe the solution you'd like**

An optional list of allowed embedding origins on each status page, set in the status page form alongside the custom domain. The existing status-page document CSP middleware would look the page up (by `/status/public/:url` or by custom domain, cached in the same way as the CORS origin middleware) and emit `frame-ancestors 'self' ` for that document only. Every other document keeps `frame-ancestors 'self'`. Origins would be validated as `https?://host[:port]` with no path, and only honoured for published pages.

**Describe alternatives you've considered**

An instance-wide environment variable listing allowed origins. Simpler, but it applies to every status page on the instance. The per-page field fits better with the existing custom domain feature.

**Additional context**

Browsers enforce the intersection of all CSP headers, so a second header cannot widen the helmet default. The change would remove `frame-ancestors` from the global helmet policy and emit it per request from the status-page CSP middleware instead. Open question: whether `X-Frame-Options` should also be dropped for status page documents. Browsers that support `frame-ancestors` ignore it when both are present.

Happy to take this on and open a PR against `develop` if it is acceptable.

Start by inspecting the global helmet policy, the existing status-page document CSP middleware, and the status-page form and custom-domain handling. Trace how the CORS origin middleware performs its lookup and caching. Done means validated origins are applied only to published status-page documents, other documents retain frame-ancestors 'self', and the X-Frame-Options behavior is resolved and tested.

Written by the indexing model from the issue text.