Restore iframe embed with full-width, auto-height CSS

- Removed narrow max-width/margin from generated HTML page
- iframe now spans full card width (100%)
- onload JS auto-sizes iframe height to content so nothing is cut off
- Falls back to 500px if cross-origin restriction ever applies

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server.js

@@ -1548,16 +1548,23 @@ app.post('/api/admin/upload-attachment', requirePin, async (req, res) => {
     return res.status(500).json({ error: `Could not save file: ${err.message}` });
   }
 
-  // Convert to HTML for inline rendering
-  let htmlBody = null;
+  // Convert to HTML for the iframe viewer
+  let htmlUrl = null;
   try {
-    const { value } = await mammoth.convertToHtml({ buffer });
-    htmlBody = value || null;
+    const { value: bodyHtml } = await mammoth.convertToHtml({ buffer });
+    const htmlFilename = `${uuid}.html`;
+    const page = `<!doctype html><html><head><meta charset="utf-8">
+<style>*{box-sizing:border-box}body{font-family:sans-serif;margin:0;padding:1rem;line-height:1.6;font-size:15px}
+img{max-width:100%}table{border-collapse:collapse;width:100%}td,th{border:1px solid #ccc;padding:.4em .6em}
+h1,h2,h3{margin-top:1em}</style>
+</head><body>${bodyHtml}</body></html>`;
+    await writeFile(join(ATTACHMENTS_DIR, htmlFilename), page);
+    htmlUrl = `/api/attachments/${htmlFilename}`;
   } catch (_) {
     // preview failed — download link still works
   }
 
-  return res.json({ url: `/api/attachments/${filename}`, htmlBody, originalName });
+  return res.json({ url: `/api/attachments/${filename}`, htmlUrl, originalName });
 });
 
 app.get('/health', (req, res) => res.json({ ok: true }));