fix(export): let the keepsake download through X-Frame-Options on iOS

The keepsake download navigates a hidden, same-origin iframe (deliberately:
a top-level navigation to a 404/429 would unload the PWA). Caddy stamped a
site-wide `X-Frame-Options: DENY` that also covered the proxied `/api/*`.

Blink hands a `Content-Disposition: attachment` response to the download
manager at the network layer, so Chromium never noticed. WebKit enforces XFO
on the frame navigation first and aborts the load — so on iOS Safari, the
app's primary platform, tapping Download did nothing at all, silently.

Carve the two export endpoints out to SAMEORIGIN, which still blocks
cross-origin framing. Implemented as two disjoint matchers rather than an
override: Caddy applies the FIRST `header` directive outermost, so it wins on
write and a later, more specific `header` is silently ignored (verified
against the running test stack).

Also close the test gap that let this ship:

- `06-export` ran on chromium-desktop only; add it to `webkit-iphone`, the
  only engine that enforces XFO on the download frame.
- No test in the suite ever clicked a download button — every archive
  assertion used Node `fetch`, which has no frame and no XFO enforcement.
  Add a spec that clicks it and awaits a real `download` event. Verified
  falsifiable: with the blanket DENY reinstated it fails and reports the
  WebKit refusal as the cause.
- Fix `ExportPage`'s card-scoped locators, which matched nothing: the cards
  carry `class="card p-5"` (a Tailwind `@apply` component class), never the
  `rounded-xl` the page object looked for. This had left the "shows enabled
  download buttons" test red on main.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

e2e/Caddyfile.test

@@ -12,10 +12,17 @@
     # Mirror prod's security headers (minus HSTS, which is HTTPS-only).
     header {
         X-Content-Type-Options "nosniff"
-        X-Frame-Options "DENY"
         Referrer-Policy "strict-origin-when-cross-origin"
     }
 
+    # Mirror prod's export carve-out: the keepsake download targets a hidden
+    # same-origin iframe, and WebKit enforces XFO before Content-Disposition.
+    # Two disjoint matchers, not an override — see the comment in ../Caddyfile.
+    @framable path /api/v1/export/zip /api/v1/export/html
+    @not_framable not path /api/v1/export/zip /api/v1/export/html
+    header @framable X-Frame-Options "SAMEORIGIN"
+    header @not_framable X-Frame-Options "DENY"
+
     reverse_proxy /api/* app:3000
     reverse_proxy /media/* app:3000
     reverse_proxy /health app:3000