feat: embed frontend in backend

server/src/WebDrop.Api/WebDropApp.cs

@@ -1,5 +1,6 @@
 using System.Threading.RateLimiting;
 using WebDrop.Core;
+using WebDrop.Frontend;
 using WebDrop.Storage;
 
 namespace WebDrop.Api;
@@ -80,6 +81,7 @@ public static class WebDropApp
         if (options.CorsOrigins.Length > 0) app.UseCors();
         app.UseWebSockets(new WebSocketOptions { KeepAliveInterval = LogStreamer.Heartbeat });
         app.UseRateLimiter();
+        EmbeddedFrontend.Use(app, options.Captcha.ApiEndpoint);
         app.MapApi(options, app.Services.GetRequiredService<ICaptchaVerifier>());
         return app;
     }
@@ -114,7 +116,7 @@ public static class WebDropApp
         QueueLimit = 0,
     };
 
-    /// <summary>API 不提供任何页面。禁用缓存、禁止嗅探、不发送 Referer、不允许被嵌入。</summary>
+    /// <summary>API 默认禁止缓存、嗅探和嵌入;嵌入式前端的页面策略由静态模块单独设置。</summary>
     private static Task SecurityHeaders(HttpContext ctx, RequestDelegate next)
     {
         var h = ctx.Response.Headers;