fix(headers): allow localhost frame-ancestors for preview

Lets local karnstack dev iframe https://resumex.karnstack.com/preview/*
without tripping the production CSP.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: karngyan

public/_headers

@@ -5,7 +5,7 @@
 # CSP frame-ancestors is the modern, browser-respected directive. X-Frame-Options
 # ALLOW-FROM is shipped alongside for legacy compatibility; modern browsers ignore it.
 /preview/*
-  Content-Security-Policy: frame-ancestors 'self' https://karnstack.com https://*.karnstack.com
+  Content-Security-Policy: frame-ancestors 'self' https://karnstack.com https://*.karnstack.com http://localhost:* http://127.0.0.1:*
   X-Frame-Options: ALLOW-FROM https://karnstack.com
 
 # Templates manifest is read by the karnstack landing page. Short cache so newly