Harness origin (use as origin_domain when creating a step-up):
Framing
— a blank frame means the engage page refused this parent
(frame-ancestors); the violation shows only in the browser console.
Usage:
Allowed engage hosts: *.tunic.tech, *.tunicpay.com,
*.tnpy.dev (https only), plus localhost /
127.0.0.1 (http or https).