Index: src/server.js
===================================================================
--- src/server.js	(revision a3e0746df955a23ca4c1a4aded56ac216af78d17)
+++ src/server.js	(revision 07de4643e4f06cd942b3afd21c09df855614ea4b)
@@ -125,14 +125,9 @@
       mediaSrc: ["'self'", "https:", "blob:"],
       fontSrc: ["'self'"],
-      frameSrc: [
-        "'self'",
-        "https://open.spotify.com",
-        "https://w.soundcloud.com",
-        "https://bandcamp.com",
-        "https://embed.music.apple.com",
-        "https://www.youtube-nocookie.com",
-        "https://www.youtube.com",   // YouTube IFrame API sometimes creates a www.youtube.com iframe
-        "https://player.vimeo.com",
-      ],
+      // Embeds (platform players + cross-site Klonkt audio players) are framed broadly:
+      // ANY https origin, so embeds work in any context (feed, htmx/PWA nav, public pages).
+      // The sensitive /authorize_interaction page tightens frame-src back to 'self' in
+      // renderPage — it shows untrusted remote content next to the interact buttons.
+      frameSrc: ["'self'", "https:"],
     },
   },