fix: file preview URLs and milestone web link saving

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/routes/files.ts

@@ -1,4 +1,4 @@
-import { Router } from 'express';
+import { Router, type Response } from 'express';
 import path from 'path';
 import fs from 'fs';
 import { prisma } from '../lib/prisma';
@@ -8,6 +8,16 @@ import { AppError } from '../middleware/errorHandler';
 
 const router = Router();
 
+/** Vercel 상세 창에서 PDF 등 iframe 미리보기 허용 */
+function allowCrossOriginPreview(res: Response) {
+  res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+  res.setHeader(
+    'Content-Security-Policy',
+    "frame-ancestors 'self' https://eene-dashboard.vercel.app https://*.vercel.app http://localhost:3000",
+  );
+  res.removeHeader('X-Frame-Options');
+}
+
 /** multer가 latin1로 전달하는 한글 파일명 복원 */
 function fixOriginalName(name: string): string {
   try {
@@ -70,6 +80,7 @@ router.get('/:id/view', async (req, res, next) => {
     if (!file) throw new AppError(404, '파일을 찾을 수 없습니다.');
     if (!fs.existsSync(file.path)) throw new AppError(404, '파일이 서버에 없습니다.');
 
+    allowCrossOriginPreview(res);
     res.setHeader('Content-Type', file.mimetype);
     res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(file.originalName)}"`);
     fs.createReadStream(file.path).pipe(res);