fix: prevent private network prompts in debug inspector

[stevene1919]

Summary

Fixes Chrome Private Network Access prompts caused by scripts in the scraper debug preview.

• Sandbox the debug preview iframe so fetched page scripts cannot execute.
• Support Private Network Access preflight requests in the backend.
• Document the fix in the changelog.

Verification

• Frontend build passed
• Backend TypeScript build passed
• Frontend tests passed
• Lint passed
• Runtime PNA preflight check passed

Closes #75

[stevene1919]

The issue occurs on the login page too (as noted in #75), not just the debug inspector. The PNA prompt likely happens because the frontend is making API calls via hardcoded or absolute localhost URLs instead of relative paths when running behind the Cloudflare Tunnel.

To fully resolve #75, we should also:

1. Verify that VITE_API_URL doesn't hardcode http://localhost:3001 or similar absolute URLs
2. Ensure the frontend falls back to relative /api paths in production builds
3. Add test coverage for API calls during login behind a reverse proxy scenario

Without this, users will still see the PNA prompt when logging in or making other API requests, even after merging.