LiveView wrapper that embeds the Godot web export (/game/index.html)
inside the app layout so the navbar is visible.
The game itself runs in an iframe with its own COOP/COEP headers
(set by GamendWeb.Plugs.GameHeaders) so SharedArrayBuffer works.
When the user is session-authenticated, this LiveView mints a short-lived
JWT access-token (and a refresh-token) so the Godot game can call the API.
They are handed over through localStorage only: the GameAuth hook writes
gamend_access_token / gamend_refresh_token, and the game reads them with
JavaScriptBridge.eval("localStorage.getItem('gamend_refresh_token')").
The iframe src is a CONSTANT and must stay one. mount/2 runs at least
twice per page (dead render, then connected mount, then again on every socket
reconnect) and mints fresh tokens each time. When those tokens were part of
the src fragment, every mount produced a different URL, the browser reloaded
the iframe, and a second Godot/WASM instance booted before the first was
collected — roughly doubling the heap and getting the tab killed on iOS.
phx-update="ignore" does not save us here; the only safe answer is a src
that cannot change.