The Google Maps iframe was blocked by CSP (frame-src falls back to default-src 'self'). Switched the doctor-page location map to react-leaflet with OpenStreetMap tiles — no iframe, and CSP already allows https image tiles (img-src 'self' https:). Marker icons are bundled from the leaflet package (no CDN). MapView is dynamically imported (ssr:false) since Leaflet needs window. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>