Private local widget wrapper

Pass a URL in the fragment as #url=..., or in the query string as ?url=.... Only localhost, loopback, and private Tailscale HTTPS hostnames are allowed.