fix: resolve ES module bare specifiers in widget iframe

[GeneralJerel]

Summary

• Import map added to the widget iframe shell, mapping three, gsap, d3, and chart.js to esm.sh CDN URLs so bare specifiers like import "three" resolve correctly in the sandboxed srcdoc iframe
• Module auto-detection in the bridge script — dynamically injected <script> tags containing import/export syntax are automatically promoted to type="module" so the import map applies even when the LLM omits the type attribute
• Skill instructions updated — Three.js guidance now prefers the ES module pattern (import * as THREE from 'three') over the legacy r128 UMD script tag

Test plan

• Run pnpm dev and ask the agent to create a Three.js 3D visualization
• Verify the 3D scene renders without Failed to resolve module specifier "three" console errors
• Verify both ESM (import * as THREE from 'three') and UMD (<script src="cdnjs...">) patterns work
• Verify other widget types (charts, SVG diagrams) still render correctly

🤖 Generated with Claude Code

[GeneralJerel]

Review Notes

sandbox allow-same-origin (addressed)

allow-scripts + allow-same-origin effectively negates the iframe sandbox — the iframe can access window.parent, DOM, cookies, etc. For this demo (no auth, no client-side secrets) the practical risk is low. Added a code comment referencing issue #3 and posted investigation context there (blob URLs, sandbox subdomain as alternatives).

Auto-detect regex may false-positive

The module auto-detection regex at widget-renderer.tsx:433:

/\b(import\s|export\s|import\()/.test(scriptInfo.text)

matches inside comments and strings (e.g. // We don't import anything), which would promote a non-module script to type="module" — changing execution semantics (strict mode, deferred execution, this is undefined). Consider anchoring to start-of-line or only promoting when a mapped bare specifier is present.

useMemo with ref (minor)

sourceRef.current is read inside useMemo in save-template-overlay.tsx but isn't a dependency. Works for the initial-render capture case, but if pending arrives after mount the memo won't recompute. If late arrivals aren't possible, a comment noting that assumption would help.

Looks good otherwise

• Import map placement before CSP meta is correct
• esm.sh already in CSP script-src and connect-src
• SKILL.md update guiding LLM toward type="module" reduces reliance on auto-detect