fix(app): normalize the head tag before creating the final sandbox

[asasemahmed]

websandbox requires the literal string <head> in frameContent and throws iFrame content must have "<head>" tag otherwise. ensureHead() accepts any /<head[\s>]/i, so generated documents with <head lang="en"> or <HEAD> pass through unchanged. The final sandbox then fails to load. The error is logged as "Failed to load sandbox module", and the preview has already been torn down, so the user is left with an empty box. Full documents with a head are expected here, because the tool description asks for CDN scripts in <head>.

ensureHead() now:

• keeps HTML that already has <head>,
• rewrites an existing head open tag to a plain <head> (attributes on head have no effect),
• otherwise adds one as before.

buildFinalFrameContent() then inserts the head content right after that literal tag, which also means a <header> element can never be taken for the head.

Tests: the new frame-content.test.ts covers <head lang="en">, <HEAD> and a <header>-only body. The renderer tests mock websandbox, which is why this wasn't caught.