The desktop CSP listed only known embed hosts in frame-src, so every room widget that is not one of them (Jitsi, Etherpad, Grafana, bots) showed a blank frame; the web deploy allows https: frames (#205). Match it. Widget frames are sandboxed by cinny and same-origin widget URLs are refused (isWidgetUrlSafe), so this does not widen what a widget can do to the app. Fixes #33 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5