fix: apply security headers middleware to enable iframe embedding

The SecurityHeaders middleware was not being applied to the router,
causing the "Allow iframe embedding" setting to not take effect.
This fix properly applies the middleware with the saved settings,
allowing iframe embedding to work when enabled.

addresses #351

internal/api/router.go

@@ -53,9 +53,18 @@ func NewRouter(cfg *config.Config, monitor *monitoring.Monitor, wsHub *websocket
 	// Start forwarding update progress to WebSocket
 	go r.forwardUpdateProgress()
 	
-	// Wrap with error handler middleware only
+	// Load system settings to configure security headers
+	allowEmbedding := false
+	allowedOrigins := ""
+	if systemSettings, err := r.persistence.LoadSystemSettings(); err == nil && systemSettings != nil {
+		allowEmbedding = systemSettings.AllowEmbedding
+		allowedOrigins = systemSettings.AllowedEmbedOrigins
+	}
+	
+	// Apply security headers with embedding configuration
+	// Then wrap with error handler middleware  
 	// Note: TimeoutHandler breaks WebSocket upgrades
-	return ErrorHandler(r)
+	return ErrorHandler(SecurityHeadersWithConfig(r, allowEmbedding, allowedOrigins))
 }
 
 // handleDiscovery returns cached discovery results