fix(export): let the keepsake download through X-Frame-Options on iOS

The keepsake download navigates a hidden, same-origin iframe (deliberately:
a top-level navigation to a 404/429 would unload the PWA). Caddy stamped a
site-wide `X-Frame-Options: DENY` that also covered the proxied `/api/*`.

Blink hands a `Content-Disposition: attachment` response to the download
manager at the network layer, so Chromium never noticed. WebKit enforces XFO
on the frame navigation first and aborts the load — so on iOS Safari, the
app's primary platform, tapping Download did nothing at all, silently.

Carve the two export endpoints out to SAMEORIGIN, which still blocks
cross-origin framing. Implemented as two disjoint matchers rather than an
override: Caddy applies the FIRST `header` directive outermost, so it wins on
write and a later, more specific `header` is silently ignored (verified
against the running test stack).

Also close the test gap that let this ship:

- `06-export` ran on chromium-desktop only; add it to `webkit-iphone`, the
  only engine that enforces XFO on the download frame.
- No test in the suite ever clicked a download button — every archive
  assertion used Node `fetch`, which has no frame and no XFO enforcement.
  Add a spec that clicks it and awaits a real `download` event. Verified
  falsifiable: with the blanket DENY reinstated it fails and reports the
  WebKit refusal as the cause.
- Fix `ExportPage`'s card-scoped locators, which matched nothing: the cards
  carry `class="card p-5"` (a Tailwind `@apply` component class), never the
  `rounded-xl` the page object looked for. This had left the "shows enabled
  download buttons" test red on main.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

e2e/playwright.config.ts

@@ -146,8 +146,18 @@ export default defineConfig({
       // that on `@smoke` — which exists on exactly two specs — meant the entire iOS guarantee was
       // one happy path and one join test. Every other UA here is a secondary browser and a smoke
       // check is proportionate; WebKit is not. Give it the core journeys the guest actually walks:
-      // join/recover, upload, and browse the feed.
-      testMatch: ['**/__smoke/**', '**/01-auth/**', '**/02-upload/**', '**/03-feed/**'],
+      // join/recover, upload, browse the feed — and take the keepsake home.
+      //
+      // 06-export is here because WebKit is the ONLY engine that enforces X-Frame-Options on the
+      // hidden download iframe. Excluding it is what let a site-wide `XFO: DENY` ship a keepsake
+      // download that silently did nothing on iOS. See 06-export/download-iframe.spec.ts.
+      testMatch: [
+        '**/__smoke/**',
+        '**/01-auth/**',
+        '**/02-upload/**',
+        '**/03-feed/**',
+        '**/06-export/**',
+      ],
     },
     {
       name: 'firefox-android',