DDFE-729 — third-party framing of care-core fragments

Each case below embeds a fragment from and reports whether this page's origin was allowed to frame it.

This page's origin, which is what the browser matches against frame-ancestors:

The same headers, without a browser — run these against the deployment you are testing:

A case reporting FAIL on the positive test almost always means this origin is not in that route's frameAncestors list yet. Check the CSP header above: the origin has to appear verbatim, scheme included.