Helmet's default frameguard sends X-Frame-Options: SAMEORIGIN on every
response. Megapay/the issuing bank embeds /admin/pay/:merTrxId and
/admin/epay/return in an iframe as part of the OTP/3DS redirect flow;
same-origin-only framing made Chrome show a blank frame with "<domain>
đã từ chối kết nối" even though the payment succeeded server-side (IPN
still processed correctly - this was a display-only issue).

Scoped fix: strip the header only on these two payment-facing routes via
a small route-local middleware. Every other /admin/* route (login,
transactions, accounts) keeps the clickjacking protection unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017KPzWwuTEeX2vXGXvyGn4q