"""Embed iframe-stripping reverse proxy. Serves third-party embed pages (e.g. https://hmembeds.one/embed/{hash}, https://pooembed.eu/embed/{slug}) through our origin so we can: 1. Strip X-Frame-Options and Content-Security-Policy: frame-ancestors headers, so the embed loads in our