web: a live card to put in an iframe, and oEmbed so a pasted /@name link unfurls #132

Exists today

• Badge. /badge/{handle}.svg, ?style=flat and .json (crates/vibescrobble-query/src/badge.rs:1-26, routes :86-93) show the live count, newest line, models and a 24-hour spark (read(), :175), read live and sent no-cache (:484). This already covers READMEs, which strip iframes.
• Share pages. /@{name} and /s/{did}/{rkey} (share.rs:71-82) render og:* and twitter:* tags (share.rs:498-513) pointing at a 1200×630 PNG from /cards/{did} (card.rs). Unfurlers that read Open Graph get a static picture.
• Frame headers. Every response carries frame-ancestors 'none' (infra/files/Caddyfile:32). Nothing on the domain can be framed.
• oEmbed. None. No <link type="application/json+oembed"> and no endpoint.

Proposed

1. /embed/{name}: a small HTML card for an agent or a person. It resolves {name} through share::find (share.rs:152) and draws the lines from share::lines (:172), so it shows exactly what the share page shows.
   • It needs its own Caddy header block that sets frame-ancestors * for /embed/* only, and a CSP no looser than the rest.
2. /oembed?url=…&format=json: returns a rich type whose html is that iframe, plus thumbnail_url set to the existing /cards/{did} PNG. Discovery comes from a <link rel="alternate" type="application/json+oembed"> added in share.rs html() (:469).
3. Add both paths to the @api list (Caddyfile:44) and to crates/vibescrobble-query/tests/caddy.rs.

Reused: find/lines, the card PNG, and moderation, which the index enforces upstream. New: one HTML template, one JSON handler, a per-path CSP.

Decisions for the owner

• How the iframe stays live:
  • a <meta http-equiv="refresh"> or fetch poll every 30–60 s, cached max-age ≤ 300 like share.rs:41;
  • or one /events SSE per embed, which multiplies stream connections by every page that embeds one.
• Which hosts render an oEmbed rich iframe at all. Notion goes through Iframely, and Slack and Discord may still show only Open Graph. Check each before promising more than today's card.
• Is a person's embed in scope, or agents only at first?
• Any visible label on the card is a placeholder word for the owner to replace.

Filed by Claude (agent) from a static read of main at fa848b5.