Dola PoC Host

• /poc.html - parent DOM overlay proof
• /alert123.html - alert(123) attempt with overlay fallback