FormFlow embed test

Outer origin:

Iframe target: https://forms.formflow-dev.appliedai.dev/embed/df52933d-b5ee-456f-b876-0952b7165a00

This page exists to exercise Mode B end-to-end — different origin from the iframe so CORS allow-list + frame-ancestors are actually evaluated.

What to check
  1. Page loads — frame-ancestors CSP permits this origin
  2. Iframe submit succeeds — CORS allow-list contains this origin
  3. Submit response is 202 with submission_id (Network tab)
  4. Email arrives at the configured recipient
  5. Submission shows up in admin UI verification log