Allow framing on payment/return pages to fix Megapay OTP iframe blocked by X-Frame-Options

Helmet's default frameguard sends X-Frame-Options: SAMEORIGIN on every
response. Megapay/the issuing bank embeds /admin/pay/:merTrxId and
/admin/epay/return in an iframe as part of the OTP/3DS redirect flow;
same-origin-only framing made Chrome show a blank frame with "<domain>
đã từ chối kết nối" even though the payment succeeded server-side (IPN
still processed correctly - this was a display-only issue).

Scoped fix: strip the header only on these two payment-facing routes via
a small route-local middleware. Every other /admin/* route (login,
transactions, accounts) keeps the clickjacking protection unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017KPzWwuTEeX2vXGXvyGn4q

app/routes/admin.server.routes.js

@@ -31,7 +31,18 @@ module.exports = function (app) {
 
   app.route("/admin/transactions/new").get(requireLogin, admin.newTransactionForm);
 
-  app.route("/admin/pay/:merTrxId").get(admin.payPage);
-  app.route("/admin/epay/return").get(admin.epayReturn);
+  // Helmet's frameguard sets X-Frame-Options: SAMEORIGIN globally (config/express.js),
+  // which blocks these two pages when Megapay/the issuing bank embeds them in an iframe
+  // as part of the OTP/3DS redirect flow - Chrome then shows a blank frame with
+  // "<domain> đã từ chối kết nối" even though the payment itself completed successfully
+  // server-side via IPN. Only these two payment-facing pages need to allow that framing;
+  // every other /admin/* route keeps the clickjacking protection.
+  function allowFraming(req, res, next) {
+    res.removeHeader("X-Frame-Options");
+    next();
+  }
+
+  app.route("/admin/pay/:merTrxId").get(allowFraming, admin.payPage);
+  app.route("/admin/epay/return").get(allowFraming, admin.epayReturn);
   app.route("/admin/epay/ipn").post(admin.epayIPN);
 };