HTML files now render in an iframe served from S3 (tinqs-git-preview
bucket) instead of Gitea's raw endpoint which forces text/plain.
SWR flow: first request uploads blob to S3 synchronously, subsequent
requests redirect to presigned S3 URL instantly. When the blob SHA
changes (new commit), the stale version is served immediately while
the new version uploads in the background.
Security: iframe uses sandbox="allow-scripts" only (no allow-same-origin).
S3 is a different origin from git.arikigame.com, so even if JS runs in
the iframe it cannot access Gitea session cookies or API tokens.
Config: [html_preview] section in app.ini, disabled by default.
Release pipeline auto-adds config on first deploy.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
ozan
a845b744b7