fix: switch Cusdis to iframe embed to avoid CORS

- Replace <script src> approach with programmatic iframe creation
- No cross-origin script loading — avoids CORS blocks entirely
- Guard against missing container with null check

overrides/partials/comments.html

@@ -1,13 +1,28 @@
 {% if page.meta.comments %}
 <h2 id="__comments">{{ lang.t("meta.comments") }}</h2>
-<div id="cusdis_thread"
-  data-host="{{ config.extra.cusdis.host }}"
-  data-app-id="{{ config.extra.cusdis.app_id }}"
-  data-page-id="{{ page.canonical_url }}"
-  data-page-url="{{ page.canonical_url }}"
-  data-page-title="{{ page.title }}"
-  data-theme="auto">
-</div>
-<script async defer src="{{ config.extra.cusdis.host }}/js/cusdis.es.js"></script>
+<div id="cusdis_thread"></div>
+<script>
+(function() {
+  var host = "{{ config.extra.cusdis.host }}";
+  var appId = "{{ config.extra.cusdis.app_id }}";
+  var pageId = "{{ page.canonical_url }}";
+  var pageUrl = "{{ page.canonical_url }}";
+  var pageTitle = "{{ page.title }}";
+  var theme = "auto";
+
+  var iframe = document.createElement("iframe");
+  iframe.src = host + "/iframe/thread"
+    + "?app_id=" + encodeURIComponent(appId)
+    + "&page_id=" + encodeURIComponent(pageId)
+    + "&page_url=" + encodeURIComponent(pageUrl)
+    + "&page_title=" + encodeURIComponent(pageTitle)
+    + "&theme=" + theme;
+  iframe.style.cssText = "width:100%;border:none;min-height:300px";
+  iframe.title = "Comments";
+
+  var container = document.getElementById("cusdis_thread");
+  if (container) container.appendChild(iframe);
+})();
+</script>
 <noscript>Please enable JavaScript to view the comments.</noscript>
 {% endif %}