{# Single-file HTML: framed from Spaces (cross-origin). ZIP packages: framed from this site; omit allow-same-origin so uploaded JS cannot read banfes.com cookies. #}