feat(embed): album title overlay + in-host photo detail modal (replaces new-tab open)

- viewer: EmbedStream shows album title overlay top-left (ellipsis, avoids collapse zone); photo click posts open-photo {url} to host instead of window.open (direct-open still new tab)
- loader v2: open-photo message (origin+source whitelisted, URL must match widget origin) opens host overlay modal with embedded viewer deep-link iframe, close button/Esc/scrim dismiss, single instance, cleaned on destroy
- tests: click case asserts modal iframe deep link + no popup + close button dismiss; viewer 244 + loader 36 green

Co-Authored-By: Claude Code <noreply@anthropic.com>

apps/viewer/e2e/embed-v2.spec.ts

@@ -337,7 +337,9 @@ test.describe.serial('E04 interactions: pause, click lock, keyboard, destroy', (
       })
       .toContain(`/p/${photoId}`);
     await page.screenshot({ path: `${OUT_ROOT}/actual/server/photo-modal.png` });
-    await page.keyboard.press('Escape');
+    await page
+      .locator('button[aria-label*="Close photo detail"], button[aria-label*="关闭照片详情"]')
+      .click();
     await expect(modalFrame).toHaveCount(0);
   });