feat(security): allow analytics subdomain to iframe the site

Replace X-Frame-Options: SAMEORIGIN with a CSP frame-ancestors directive
so analytics.schoolcompare.co.uk (Umami heatmap/recorder) can embed the
site while all other origins stay blocked. X-Frame-Options cannot allow a
specific sibling subdomain (ALLOW-FROM is deprecated/ignored by modern
browsers), so frame-ancestors is the correct replacement.

Also update the nginx snippet in DEPLOYMENT.md to match, so the reverse
proxy doesn't re-inject a conflicting X-Frame-Options header.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nextjs-app/next.config.js

@@ -54,8 +54,12 @@ const nextConfig = {
             value: 'on',
           },
           {
-            key: 'X-Frame-Options',
-            value: 'SAMEORIGIN',
+            // Allow the analytics subdomain (Umami heatmap/recorder) to embed
+            // the site while blocking all other origins. frame-ancestors is the
+            // modern replacement for X-Frame-Options, which cannot allow a
+            // specific sibling subdomain (ALLOW-FROM is deprecated/ignored).
+            key: 'Content-Security-Policy',
+            value: "frame-ancestors 'self' https://analytics.schoolcompare.co.uk",
           },
           {
             key: 'X-Content-Type-Options',