Serve an embedded data-app HTML artifact with the signed token injected

Serve the stripped data-app HTML with the embed token injected.

This is the top-level navigation URL that customers drop into an iframe on their own site. The token lives in the URL query string (?t=...); there is no separate header. Auth is handled by :class:DataAppEmbedTokenFromQuery which verifies the signed token before the handler body runs. On success, the HTML arrives with:

• Cache-Control: private, no-store (tokens are per-request)
• Referrer-Policy: no-referrer (prevents URL leak via Referer)
• Content-Security-Policy: frame-ancestors <hosts> (click-jack protection)

The browser's definite-runtime reads window.__DEFINITE_EMBED from the injected script tag and sends the token as Authorization: Bearer ... on every /v4/data-apps/query call.