Render an app's iframe-host page.

The app's frontend bundle is concatenated into an iframe srcdoc with bb-bridge.js prepended; the page embeds output_name → block_id index so bb.query in the iframe round-trips through /api/apps/{id}/blocks/{block_id}/run.

Visibility model mirrors workbooks: private is owner-only; link_view lets any caller (including anonymous) render the page as a viewer. Viewer renders carry is_viewer=True so the host bridge short-circuits interaction postMessages — viewers see the SSR'd snapshot, but bb.query / bb.refresh are owner-only at the route layer too (see app_routes.py).