EmptyArtboardContent.save() accepted any string as renderUrl — a relative
path or the Originmain app URL would cause the artboard iframe to resolve
against the Originmain origin, loading the app inside itself.
- Added URL validation (same as UrlOnboardingOverlay) with inline error UI
- toCanvasArtboard now validates renderUrl at read time so stale bad data
already in the DB is also guarded against
- CanvasArtboard now carries artboard_type, isolation_component,
isolation_file, isolation_props so phase-3 isolation artboards render
correctly; previously these fields were silently dropped by the hook
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
