drop the sandbox attribute, which was doing nothing

Gitea needs allow-same-origin to keep a session and allow-scripts for the
interface to work, and those two together give back everything sandbox takes
away. The browser says so on every load: "an iframe which has both
allow-scripts and allow-same-origin can escape its sandboxing."

So it was decoration that emitted a warning nobody can act on, which is how
people learn to ignore warnings. What actually stands here is that this is
Gitea's own interface, on the platform's own origin, through a proxy the
platform wrote.

web/GiteaFrame.tsx

@@ -105,9 +105,16 @@ export const GiteaFrame = () => {
         src={FRAME_SRC}
         title="Gitea"
         className="h-full w-full border-0"
-        // Same origin, so `allow-same-origin` is what lets Gitea keep its session at all. Scripts and
-        // forms are Gitea's own — this is its interface, not untrusted content.
-        sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-downloads"
+        // NO `sandbox`, deliberately.
+        //
+        // It needs `allow-same-origin` for Gitea to keep a session and `allow-scripts` for the interface
+        // to work at all — and those two together give back everything the attribute takes away. The
+        // browser says so itself: "an iframe which has both allow-scripts and allow-same-origin can
+        // escape its sandboxing."
+        //
+        // So it was decoration that emitted a warning on every load, and a warning nobody can act on
+        // teaches people to ignore warnings. What actually stands here is that this is Gitea's own
+        // interface on the platform's own origin, reached through a proxy the platform wrote.
       />
     </div>
   );