fix(pages): Let the 500 page's links escape their iframe (backport #585)

[mergify]

Problem

Both links on the 500 page are dead in the browser. Clicking either one shows a browser security page instead of the destination:

Firefox Can't Open This Page — To protect your security, docs.frappe.io will not allow Firefox to display the page if another site has embedded it.

nginx does not serve this page directly. It injects it through sub_filter as a frame:

map $upstream_status $internal_server_error_page_... {
    500     '<style>...</style><iframe src="/internal_server_error.html"></iframe><div hidden>';

An anchor with no target navigates the frame it lives in, so the destination is asked to render inside that iframe. Both destinations refuse:

$ curl -sI https://docs.frappe.io/cloud/performance-error-debugging | grep -i x-frame
x-frame-options: SAMEORIGIN
$ curl -sI https://frappecloud.com/dashboard/ | grep -i x-frame
x-frame-options: SAMEORIGIN

This is live on develop and affects both the troubleshooting guide button and the web.error.log link added in #581.

Fix

target="_blank" on both anchors. A new top-level tab is never framed, so X-Frame-Options does not apply to it.

_top would also have worked, but it replaces the error page. _blank leaves it on screen, which keeps the visited-link colour visible — useful when someone attaches a screenshot to a support ticket and we want to see whether they already opened the guide.

Test

test_iframed_pages_escape_the_frame reads the nginx template, finds which pages get wrapped in an iframe, and requires every external link on those pages to carry a target that escapes the frame (_blank or _top). Checked against the pre-fix page, it flags both anchors, so it fails without this change rather than passing vacuously.

🤖 Generated with Claude Code

---

This is an automatic backport of pull request #585 done by [Mergify](https://mergify.com).