Lightbox: fix proxy 404, cap modal size, allow multi-Civi embed

Three quick fixes off first-deploy testing:

1. /api/staff/file 404'd for valid files. Refactor fileBelongsToOrg
   to SELECT the org's and activities' file columns and JS-compare
   instead of WHERE ... OR with custom field refs (APIv4 fragility
   around nested OR + dotted custom fields). Same ownership probe,
   same shape /api/staff/report itself uses to read file values.

2. Lightbox ballooned to full report height because the staff iframe
   auto-grows to fit content (often 3000+ px). Cap to a fixed
   640px x min(92vw, 900px) box so it stays a reasonable preview
   regardless of iframe document size.

3. Production frame-ancestors blocked crm.fci.coop from iframing
   survey.fci.coop -- the CSP only included the dev Civi origin
   derived from CIVI_BASE_URL. Add CIVI_FRAME_ALLOWED_ORIGINS
   (comma-separated) so one app deploy can be embedded by both
   dev and prod Civi. Falls back to CIVI_BASE_URL for single-Civi
   compatibility.

PRODUCTION_CUTOVER.md updated inline and in the change log.

next.config.ts

@@ -43,13 +43,38 @@ const sharedHeaders = [
   },
 ];
 
-function civiOriginForCsp(): string {
-  const raw = process.env.CIVI_BASE_URL;
-  if (!raw) return "";
+/**
+ * Civi origins permitted to embed the staff report in an iframe.
+ *
+ * Reads `CIVI_FRAME_ALLOWED_ORIGINS` (comma-separated origins) so a single
+ * survey.fci.coop deployment can be framed by both the dev Civi
+ * (client.crm.fci.coop) and the production Civi (crm.fci.coop). Falls
+ * back to the origin of `CIVI_BASE_URL` when the multi-origin var isn't
+ * set so existing single-Civi deployments keep working.
+ *
+ * Each entry is validated as a parsable URL; bad values are dropped and
+ * logged at build time rather than silently making the CSP invalid.
+ */
+function civiOriginsForCsp(): string[] {
+  const explicit = process.env.CIVI_FRAME_ALLOWED_ORIGINS;
+  if (explicit) {
+    const raws = explicit.split(",").map((s) => s.trim()).filter(Boolean);
+    const origins: string[] = [];
+    for (const raw of raws) {
+      try {
+        origins.push(new URL(raw).origin);
+      } catch {
+        console.warn(`[next.config] ignoring invalid CIVI_FRAME_ALLOWED_ORIGINS entry: ${raw}`);
+      }
+    }
+    return origins;
+  }
+  const base = process.env.CIVI_BASE_URL;
+  if (!base) return [];
   try {
-    return new URL(raw).origin;
+    return [new URL(base).origin];
   } catch {
-    return "";
+    return [];
   }
 }
 
@@ -60,12 +85,13 @@ const strictHeaders = [
 ];
 
 const staffEmbedHeaders = (() => {
-  const origin = civiOriginForCsp();
-  const frameAncestors = origin ? `'self' ${origin}` : "'self'";
+  const origins = civiOriginsForCsp();
+  const frameAncestors = origins.length > 0 ? `'self' ${origins.join(" ")}` : "'self'";
   return [
     { key: "Content-Security-Policy", value: buildCsp(frameAncestors) },
     ...sharedHeaders,
     // Intentionally NO X-Frame-Options: frame-ancestors above is the policy.
+    // (X-Frame-Options can only encode one origin; CSP supersedes here.)
   ];
 })();