oEmbed provider — a pasted board link, as a live embed

The oEmbed endpoint a consumer calls after finding the discovery tag on /url/{url}/share, or after matching this provider in the public registry. Takes the pasted page URL as url (the spec shape — a registry entry declares a URL scheme plus one endpoint of this form, so a token-keyed route could never be registered), with optional maxwidth/maxheight, and returns a rich response whose html is an iframe pointing at the EXISTING embed page. Nothing new renders. Unauthenticated for a published board, like the other two unfurl surfaces. Without credentials, 401 when the link is not ours or names an unknown or unpublished board (the auth exemption covers published boards only). 404 when a published board's embed tier is not public or its author restricted which sites may frame it — both are security controls, and each one silently disables embedding by design. 501 for format=xml, which the spec allows a provider to refuse.