fix(lotus): enable strictOriginCheck on the widget transport

matrix-widget-api's PostmessageTransport accepts toWidget actions from any
origin by default; the fork added actions that inject audio, deafen, retune
the encoder and render images. EC is served same-origin with the cinny
host, so globalThis.origin === parentOrigin and the strict check passes.

Fixes #15

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/widget.ts

@@ -93,6 +93,16 @@ export const initializeWidget = (
       const parentOrigin = new URL(parentUrl).origin;
       logger.info("Widget API is available");
       const api = new WidgetApi(widgetId, parentOrigin);
+      // [lotus] matrix-widget-api's PostmessageTransport defaults
+      // strictOriginCheck to false, which would let any frame holding a
+      // handle to our window post toWidget actions (including the
+      // io.lotus.* actions below). The Lotus deployment serves EC
+      // same-origin with the host (cinny loads /public/element-call/index.html),
+      // so globalThis.origin === parentOrigin and this check passes safely.
+      // A cross-origin deployment would need to compare ev.origin to
+      // parentOrigin instead, since strictOriginCheck compares against
+      // globalThis.origin.
+      api.transport.strictOriginCheck = true;
       api.requestCapability(MatrixCapabilities.AlwaysOnScreen);
       api.requestCapability(MatrixCapabilities.MSC4039DownloadFile);