Split GenericEmbedBlock into Generic, Video, and Form embed blocks

[rchlfryn]

Description

Splits the catch-all GenericEmbedBlock into three purpose-built embed blocks, each with an explicit, self-contained security policy. Previously GenericEmbedBlock had accumulated provider-specific concessions (DonorBox's dbox-widget tag, YouTube-specific render branching), which eroded the sandboxing boundary that made the block "generic" in the first place.

The three blocks now share a single sandboxed renderer (EmbedFrame) but each supplies its own DOMPurify allow-list and iframe sandbox policy:

• Generic Embed — arbitrary HTML/iframe embeds. Sandboxed scripts allowed, but no provider-specific tags or attributes.
• Video Embed — YouTube/Vimeo/etc. <iframe> embeds. Scripts are never executed in this block.
• Form Embed — donation/form widgets that ship their own scripts (DonorBox, Classy, Eventbrite, …). The only block that opts into the broader permissions (dbox-widget tag, allowpaymentrequest and friends).

Related Issues

Fixes #977

Key Changes

• New EmbedFrame shared renderer (src/components/EmbedFrame/) with per-block addTags / addAttr / sandbox policy, plus BASE_ADD_ATTR shared attributes in policies.ts.
• New blocks: VideoEmbed and FormEmbed (config.ts + Component.tsx), refactored GenericEmbed to drop special-case logic.
• Registered all three blocks everywhere generic embed blocks was added
• Footer.tsx now renders embedded footer forms via FormEmbedBlockComponent.
• Seed data split per block type (form-embed.ts, video-embed.ts, generic-embed.ts) and added to the all-blocks and lexical-blocks seed pages.
• Migration adding *_blocks_form_embed and *_blocks_video_embed tables for pages and home_pages (and their _v version tables).

How to test

1. pnpm seed
2. pnpm dev, open the seeded "All Blocks" and "Blocks Embedded in Rich Text" pages — each shows Generic / Video / Form embeds rendering in a sandboxed iframe.
3. Verify a Video embed does not run scripts, and a Form (DonorBox) embed does.

Migration Explanation

20260612_185209_split_generic_embed_blocks is purely additive — it CREATEs the new form/video block tables for pages and home_pages plus their version tables. No existing tables (including generic_embed) are altered or dropped, so existing content is untouched. The migrate:check warnings are false positives flagging ON DELETE cascade in foreign-key definitions. Lexical/rich-text embeds store their data as JSON in existing richText columns and need no schema change.

[github-actions]

Migration Safety Check

Found 8 potential issues:

20260612_185209_split_generic_embed_blocks.ts

Warning (line 14): DELETE keyword detected - review for data loss

FOREIGN KEY (\`_parent_id\`) REFERENCES \`home_pages\`(\`id\`) ON UPDATE no action ON DELETE cascade

Warning (line 35): DELETE keyword detected - review for data loss

FOREIGN KEY (\`_parent_id\`) REFERENCES \`home_pages\`(\`id\`) ON UPDATE no action ON DELETE cascade

Warning (line 57): DELETE keyword detected - review for data loss

FOREIGN KEY (\`_parent_id\`) REFERENCES \`_home_pages_v\`(\`id\`) ON UPDATE no action ON DELETE cascade

Warning (line 79): DELETE keyword detected - review for data loss

FOREIGN KEY (\`_parent_id\`) REFERENCES \`_home_pages_v\`(\`id\`) ON UPDATE no action ON DELETE cascade

Warning (line 100): DELETE keyword detected - review for data loss

FOREIGN KEY (\`_parent_id\`) REFERENCES \`pages\`(\`id\`) ON UPDATE no action ON DELETE cascade

Warning (line 121): DELETE keyword detected - review for data loss

FOREIGN KEY (\`_parent_id\`) REFERENCES \`pages\`(\`id\`) ON UPDATE no action ON DELETE cascade

Warning (line 143): DELETE keyword detected - review for data loss

FOREIGN KEY (\`_parent_id\`) REFERENCES \`_pages_v\`(\`id\`) ON UPDATE no action ON DELETE cascade

Warning (line 165): DELETE keyword detected - review for data loss

FOREIGN KEY (\`_parent_id\`) REFERENCES \`_pages_v\`(\`id\`) ON UPDATE no action ON DELETE cascade

---

Review these patterns and add backup/restore logic if needed. See docs/migration-safety.md for guidance.

[github-actions]

Preview deployment: https://featxsplit-generic-embed-blocks.preview.avy-fx.org