One origin lolly.example.com

• / /d /t/<id> and other app routes

  The app. A clean route gets its prerendered page; anything else falls back to index.html.

  web server

• /info/… /tools/… /catalog/…

  Real files. A missing file answers 404, never the app.

  web server

• /any-site/

  The app under a second policy whose frame-src admits any secure web page.

  web server

• /api/mcp /tool/<id>.<ext> /.well-known/oauth-*

  AI agents, public renders and the image pass-through behind Add from URL.

  MCP service

• /api/ca

  Signing certificates for verified Content Credentials.

  CA service

• /api/penpot

  Send to Penpot.

  Penpot pass-through

Shaded rows are the optional services. Route them first, and keep the app fallback last so it cannot swallow them.