fix(admin): add postMessage origin validation to liveControls.ts

[0xcucumbersalad]

Summary

• Adds TRUSTED_ORIGINS allowlist and isTrustedOrigin() check to src/admin/liveControls.ts, matching the existing fix in LiveControls.tsx
• Without this check, any page that iframes the storefront can execute arbitrary JavaScript via postMessage — a framework-level XSS
• Accepts explicit deco.cx origins, any *.deco.cx subdomain, and same-origin messages

Test plan

• bun run test — 46 files, 687 tests passed
• Verify admin preview still works when storefront is embedded in admin iframe
• Verify messages from untrusted origins are rejected (no script injection)

🤖 Generated with Claude Code

---

Summary by cubic

Adds origin validation to the admin live controls postMessage handler to block untrusted iframes and prevent script injection when the storefront is embedded. Aligns src/admin/liveControls.ts with LiveControls.tsx by allowing only deco.cx origins and same-origin messages.

• Bug Fixes
  • Add TRUSTED_ORIGINS and isTrustedOrigin(); ignore messages when event.origin is not trusted.
  • Trusted: https://deco.cx, https://admin.deco.cx, https://play.deco.cx, any *.deco.cx subdomain, and same-origin.

^{Written for commit 3adb2db. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}