[sybohy]

The hosted device embed fails in current Chrome when a visitor’s VPN or split DNS resolves ecosystem.seam.co to a private address. Chrome denies the cross-origin local-network request inside the docs iframe, showing “An error occurred while loading supported devices.”

Read the catalog through two exact, same-origin Vercel rewrites on react.seam.co. The hosted EcosystemProvider uses /ecosystem/v1/, and its CSP permits only same-origin connections. Preserve filters and pagination, add the equivalent Vite development proxy, and document the routing. No API, credentials, catalog data, or docs source changes are needed.

Validation:

• Reproduced the live failure in clean Chrome 149 with default split DNS: permission denied to access the local address space.
• The same browser forced to public DNS renders 7 August and 13 KeyInCode models, isolating the cause.
• Preview deployment react-4b134jpns.seam.vc, commit 3400556: loaded within actual production August/KeyInCode guide pages in clean Chrome 149 with default split DNS; 7/13 models rendered; both same-origin summary and manufacturer requests HTTP 200. No browser security bypasses, local-network permission grants, API mocking, or request interception.
• All 73 tests, typecheck, lint, examples build, and all GitHub/Vercel checks pass.

Fixes DEVDB-463.