The Content-Security-Policy is defined in next.config.ts headers(), which Next
serializes at build time, so ALLOWED_FRAME_URLS only takes effect when it is set
before `next build`. The published Docker images are built without it, so
frame-ancestors cannot be configured at runtime and iframe embedding requires a
custom image (#3793, #2407).
Move the policy into a shared getContentSecurityPolicy() and set the header from
the Docker proxy (docker/proxy.ts) on every response, where runtime env such as
CORS_MAX_AGE and DISABLE_LOGIN is already handled. next.config.ts skips the
build-time CSP when the proxy is present, so exactly one header is sent.
Non-Docker builds are unchanged: the build-time CSP still applies and
ALLOWED_FRAME_URLS keeps working as a build-time variable there.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This introduces a user-scoped dashboard with board-style view/edit pages while keeping it unavailable in team context, and moves website targeting to component config so dashboard components can each select their own website.
Migrate i18n from react-intl to next-intl, eliminating the formatjs
compilation pipeline. Translation files now live as nested JSON in
public/intl/messages/ (single source of truth), removing the duplicated
src/lang/ directory and the copy/compile build steps. The useMessages()
hook API is preserved so all 195+ consumer components are unchanged.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Mike Cao