Allow iframe embedding via CSP frame-ancestors (config-driven)

Make MedASR load failure non-fatal; fall back to Whisper

Upload app code