AvatarSetupPage: postMessage handler does not validate event.origin → attacker-controlled signed profile deploy

## Summary
`src/components/Pages/AvatarSetupPage/AvatarSetupPage.tsx:219-357` (listener at :411) processes any `MessageEvent` without validating `event.origin`/`event.source`. On `payload.id === 'customization-done'` it takes `event.data.payload.result` as the avatar shape and deploys a profile **signed with the victim's identity**. The page is framable (no `X-Frame-Options`/CSP `frame-ancestors` in `index.html`/`vercel.json`).

## Impact
A malicious site embeds the page in an iframe and posts a crafted `controller_response`, causing a profile with attacker-chosen data to be deployed under the victim's identity during onboarding.

## Fix
Validate `event.origin`/`event.source` against the WearablePreview iframe before processing; add a CSP `frame-ancestors` directive. (Verify the onboarding flow in a browser after the change.)