Lightbox: fix proxy 404, cap modal size, allow multi-Civi embed

Three quick fixes off first-deploy testing:

1. /api/staff/file 404'd for valid files. Refactor fileBelongsToOrg
   to SELECT the org's and activities' file columns and JS-compare
   instead of WHERE ... OR with custom field refs (APIv4 fragility
   around nested OR + dotted custom fields). Same ownership probe,
   same shape /api/staff/report itself uses to read file values.

2. Lightbox ballooned to full report height because the staff iframe
   auto-grows to fit content (often 3000+ px). Cap to a fixed
   640px x min(92vw, 900px) box so it stays a reasonable preview
   regardless of iframe document size.

3. Production frame-ancestors blocked crm.fci.coop from iframing
   survey.fci.coop -- the CSP only included the dev Civi origin
   derived from CIVI_BASE_URL. Add CIVI_FRAME_ALLOWED_ORIGINS
   (comma-separated) so one app deploy can be embedded by both
   dev and prod Civi. Falls back to CIVI_BASE_URL for single-Civi
   compatibility.

PRODUCTION_CUTOVER.md updated inline and in the change log.

app/api/staff/file/route.ts

@@ -130,18 +130,17 @@ async function discoverFileFieldRefs(): Promise<FileFieldRefs> {
  * Confirm fileId is reachable from this org through the same column
  * ownership the staff report uses.
  *
- * Strategy: probe both ownership sides in parallel using APIv4 OR clauses.
- *   - Contact.get for the org itself, asking whether ANY org-side file
- *     custom field equals fileId.
- *   - Activity.get for activities with target_contact_id=orgId, asking
- *     whether ANY activity-side file custom field equals fileId.
- * If either query returns a row, the file genuinely belongs to this org.
+ * Implementation: fetch the org row and the org's activities, selecting
+ * the file-typed custom-field columns, then check in JS whether any
+ * column value equals fileId. We avoid APIv4 OR clauses against custom
+ * fields because that combination has been fragile in practice; the
+ * SELECT-and-compare path is the same shape /api/staff/report uses
+ * successfully.
  *
  * We do NOT use civicrm_entity_file for this check: our upload route
- * anchors files to the submitter's contact id (not the org's) because
- * Attachment.create needs *some* entity, but the real ownership is in
- * the custom-field column. Trusting entity_file would refuse legitimate
- * files and admit-or-refuse incorrectly for the rest.
+ * anchors files to the submitter's contact id (not the org's), so that
+ * linkage doesn't reflect ownership. The custom-field column is the
+ * authoritative chain.
  */
 async function fileBelongsToOrg(fileId: number, orgId: number): Promise<boolean> {
   let refs: FileFieldRefs;
@@ -153,40 +152,53 @@ async function fileBelongsToOrg(fileId: number, orgId: number): Promise<boolean>
     return false;
   }
 
-  const probes: Array<Promise<{ values?: unknown[] }>> = [];
+  const matches = (rows: Array<Record<string, unknown>>, fieldRefs: string[]): boolean => {
+    for (const row of rows) {
+      for (const ref of fieldRefs) {
+        const v = row[ref];
+        if (v === undefined || v === null || v === "") continue;
+        if (Number(v) === fileId) return true;
+      }
+    }
+    return false;
+  };
 
-  if (refs.org.length > 0) {
-    probes.push(
-      civi<{ id: number }>("Contact", "get", {
-        where: [
-          ["id", "=", orgId],
-          ["OR", refs.org.map((ref) => [ref, "=", fileId])],
-        ],
-        select: ["id"],
-        limit: 1,
-      }),
-    );
-  }
+  const orgProbe =
+    refs.org.length > 0
+      ? civi<Record<string, unknown>>("Contact", "get", {
+          where: [["id", "=", orgId]],
+          select: ["id", ...refs.org],
+          limit: 1,
+        }).catch((e: unknown) => {
+          console.error(
+            "[staff/file] Contact.get probe failed:",
+            e instanceof Error ? e.message : String(e),
+          );
+          return { values: [] as Array<Record<string, unknown>> };
+        })
+      : Promise.resolve({ values: [] as Array<Record<string, unknown>> });
 
-  if (refs.activity.length > 0) {
-    probes.push(
-      civi<{ id: number }>("Activity", "get", {
-        where: [
-          ["target_contact_id", "=", orgId],
-          ["activity_type_id:name", "=", ACTIVITY_TYPE_NAME],
-          ["OR", refs.activity.map((ref) => [ref, "=", fileId])],
-        ],
-        select: ["id"],
-        limit: 1,
-      }),
-    );
-  }
+  const activityProbe =
+    refs.activity.length > 0
+      ? civi<Record<string, unknown>>("Activity", "get", {
+          where: [
+            ["target_contact_id", "=", orgId],
+            ["activity_type_id:name", "=", ACTIVITY_TYPE_NAME],
+          ],
+          select: ["id", ...refs.activity],
+          limit: 500,
+        }).catch((e: unknown) => {
+          console.error(
+            "[staff/file] Activity.get probe failed:",
+            e instanceof Error ? e.message : String(e),
+          );
+          return { values: [] as Array<Record<string, unknown>> };
+        })
+      : Promise.resolve({ values: [] as Array<Record<string, unknown>> });
 
-  if (probes.length === 0) return false;
-
-  const results = await Promise.allSettled(probes);
-  return results.some(
-    (r) => r.status === "fulfilled" && Array.isArray(r.value.values) && r.value.values.length > 0,
+  const [orgRes, actRes] = await Promise.all([orgProbe, activityProbe]);
+  return (
+    matches(orgRes.values ?? [], refs.org) || matches(actRes.values ?? [], refs.activity)
   );
 }