Staff report: CSP frame-ancestors + frame-mode + WebForm-mw Civi extension

App side:
- Per-route CSP: /staff/report now sets frame-ancestors 'self'
  <CIVI_BASE_URL origin> and drops X-Frame-Options so the CiviCRM
  extension can iframe it. All other routes keep frame-ancestors
  'none' + X-Frame-Options: DENY via a path-negation source.
- Staff page recognises ?frame=1 and renders without SiteHeader/
  SiteFooter so it fills the iframe cleanly.
- StaffReportView posts its scrollHeight to the parent window via
  postMessage when framed; the Civi tab listens and auto-resizes
  the iframe (no nested scrollbar). Anchor strip drops its sticky
  positioning in frame mode since there's no internal scroll.

CiviCRM extension (civi-extension/webform-mw/, key webform-mw):
- info.xml + main hook file (webform_mw.php) implementing
  hook_civicrm_tabset to add an 'Engagement Report' tab to
  Organization contact-view pages.
- CRM/WebformMw/Page/Tab.php + Smarty template render an iframe
  pointing at <WEBFORM_MW_APP_URL>/staff/report?org=<cid>&key=&frame=1,
  with a postMessage listener that validates event.origin against
  the configured app URL before resizing.
- Config via PHP constants in civicrm.settings.php (WEBFORM_MW_APP_URL,
  WEBFORM_MW_STAFF_KEY) or matching env vars. Help banner shown when
  unconfigured.
- README documents install, config, behaviour, security caveats.

civi-extension/webform-mw/info.xml

@@ -0,0 +1,36 @@
+<?xml version="1.0"?>
+<extension key="webform-mw" type="module">
+  <file>webform_mw</file>
+  <name>WebForm-mw</name>
+  <description>
+    Adds an "Engagement Report" tab to Organization contact pages that embeds
+    the FCI Co-op Survey staff report (the WebForm-mw Next.js app) for the
+    organization. Read-only; the embedded app handles its own auth via a
+    shared staff secret.
+  </description>
+  <license>AGPL-3.0</license>
+  <maintainer>
+    <author>Food Co-op Initiative</author>
+    <email>survey@fci.coop</email>
+  </maintainer>
+  <urls>
+    <url desc="Main Extension Page">https://github.com/joelbrock/WebForm-mw</url>
+  </urls>
+  <releaseDate>2026-06-05</releaseDate>
+  <version>0.1.0</version>
+  <develStage>beta</develStage>
+  <compatibility>
+    <ver>5.50</ver>
+  </compatibility>
+  <comments>
+    Configuration is via PHP constants in civicrm.settings.php (or
+    environment variables on the CiviCRM server). See README.md.
+  </comments>
+  <classloader>
+    <psr0 prefix="CRM_" path=""/>
+  </classloader>
+  <civix>
+    <namespace>CRM/WebformMw</namespace>
+    <format>22.05.0</format>
+  </civix>
+</extension>