upgrade: adopt V8.32.0-dev.1 (theme preview iframe fix, editor simple mode)

Overlay 46 upstream items; full patch set re-applied (all patched files
reset by overlay regardless of upstream change status — lesson recorded).
Verified: theme suites 35/35; dual-baseline 418 passed vs pristine
389+29 ours, FAILED-set diff EMPTY (same 10 Windows env fails).
Live: container 8.32.0-dev.1 healthy, hesupipe 192 entries intact,
trade-pro build 203 pages 0 errors.

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/main.py

@@ -133,7 +133,13 @@ async def require_login(request:Request, call_next):
             data=_json.loads(raw)
             response=JSONResponse([x for x in data if x['id'] in ids])
     response.headers['X-Content-Type-Options']='nosniff'
-    response.headers['X-Frame-Options']='SAMEORIGIN' if path.startswith('/editor/') else 'DENY'
+    # Only read-only theme previews (and the existing editor) may be framed by this origin.
+    # All other application pages stay protected from clickjacking.
+    is_theme_preview=bool(__import__('re').fullmatch(r'/api/factory/themes/[A-Za-z0-9_-]+/preview',path))
+    response.headers['X-Frame-Options']='SAMEORIGIN' if (path.startswith('/editor/') or is_theme_preview) else 'DENY'
+    if is_theme_preview:
+        response.headers['Content-Security-Policy']="frame-ancestors 'self'"
+        response.headers['Cache-Control']='no-store'
     response.headers['Referrer-Policy']='strict-origin-when-cross-origin'
     response.headers['Cache-Control']='no-store' if path.startswith('/api/auth/') else response.headers.get('Cache-Control','no-cache')
     return response