fix(tools): repair site previews and image redirects

[jal-co]

What

• replace unsupported Cloudflare Workers redirect: "error" image fetching with bounded manual redirects
• revalidate HTTPS and public DNS on every Open Graph image redirect
• make optional image-fetch/storage failures omit the image instead of blocking a tool submission
• add a reusable cross-origin site preview used by both the editor and public tool detail
• let cross-origin sites retain the origin semantics needed for local storage while keeping forms, popups, downloads, and top navigation disabled
• keep same-origin previews on the stricter opaque-origin sandbox
• add explicit Live site and Image preview modes plus an open-in-new-tab action
• add Storybook coverage for live, image-fallback, no-image, mobile, and editor integration states
• add redirect-policy unit tests

Why

Cloudflare Workers does not implement fetch(..., { redirect: "error" }), so submitting a tool with an Open Graph image surfaced the raw edge-runtime error shown in the report. The old opaque-origin iframe also caused sites such as Shieldcn to throw when their runtime accessed local storage, leaving an error page in the preview.

How

• follows every redirect manually so each destination is checked before any request is made
• keeps SSRF protections fail-closed: HTTPS-only, public DNS-only, at most three redirects, bounded body, accepted image types only
• treats the Open Graph image as optional evidence, so a safe image failure cannot prevent the underlying verified-domain listing
• enables allow-same-origin only when the embedded site is cross-origin from Modulora; browser same-origin policy still blocks parent access
• retains the sandbox restrictions that matter for preview safety: no forms, popups, downloads, or top navigation
• provides a deliberate image fallback for sites that block framing or still cannot run embedded

Testing

• web TypeScript check
• 79 unit tests, including two new manual-redirect tests
• production build
• Storybook build
• Shieldcn live iframe rendered its real homepage under allow-scripts allow-same-origin
• editor integration rendered Shieldcn without an error alert
• image-mode toggle removed the iframe and rendered the fallback image
• desktop and 390px editor layouts had no horizontal overflow
• manual redirect tests assert every fetch uses redirect: "manual" and invalid HTTP redirect destinations fail before fetching
• git diff --check

Screenshots

• Reported failure: /Users/justin/Library/Application Support/CleanShot/media/media_uYa5nHHQTA/CleanShot 2026-07-15 at 15.51.22@2x.png
• Fixed editor live preview: /tmp/tool-editor-preview-fixed.png
• Fixed mobile editor: /tmp/tool-editor-mobile-fixed.png
• Image fallback: /tmp/external-preview-story.png