fix(extension): support cross-origin media frames

docs/TESTED_SERVICES.md

@@ -26,6 +26,8 @@ This document tracks which streaming platforms and media servers are supported b
 | **ARD / ZDF Mediathek** | Not tested | Not tested | Not tested | — | — | — | — |
 | **Vix** | ✅ Full | ✅ Full | ✅ Full | — | — | — | Everything works correctly. |
 | **JkAnime** | ✅ Full | ❌ | ❌ | 2026-08-14 | Shik3i | v3.1.0 | Player sits in a same-origin `/jkplayer/` iframe, so it needs the same-origin frame walk added in v3.1.0. No MediaSession metadata is exposed, and the page title carries no episode pattern (`… Futari 18 Sub Español …`). |
+| **Google Drive** | ⚠️ Partial | ✅ Full | ❌ N/A | 2026-08-17 | Shik3i / Codex | v3.1.2 | Live inspection confirms the visible `youtube.googleapis.com/embed` child topology; packed-Chromium fixtures cover exact-document control and recovery. A live two-peer Drive relay run is still pending. |
+| **YummyAnime** | ⚠️ Partial | ⚠️ Partial | ❌ | 2026-08-17 | Shik3i / Codex | v3.1.2 | Live inspection confirms the same-origin wrapper plus external `thealloha.club` player topology; packed-Chromium fixtures cover nested control and recovery. A live two-peer site run is still pending, and the page title lacks the selected episode. |
 
 ### Legend
 
@@ -71,4 +73,4 @@ Websites with heavily obfuscated custom players may require platform-specific wo
 
 Since v3.1.0 the content script walks **same-origin** frames, so a player wrapped in the site's own iframe is found and controlled without a site-specific workaround. This also covers `srcdoc` and `about:blank` frames, which inherit the parent origin.
 
-Frames on a **different origin** remain out of reach, because the browser blocks `contentDocument` access by design. Note that a subdomain counts as a different origin: a player served from `player.example.com` inside `example.com` is *not* reachable. Sites that embed their player from an external host (common for anime and sports streaming mirrors) fall into this category. Tracked on the roadmap as the cross-origin frame bridge.
+Since v3.1.2 the background can also inspect accessible **cross-origin** frames and inject KoalaSync into the exact frame/document containing the visible player. Frame election uses visibility and media signals so hidden preloads, trailers and ad players do not win accidentally. When browser site access for the external player origin is withheld, KoalaSync uses the existing website-access recovery flow instead of bypassing the browser permission.