App sandbox placeholder. Third-party apps run in an iframe with restricted permissions (CSP, sandbox attribute).