Fix: reload refreshing iframes without adding Back entries

[SandObserver]

Summary

• Reload a tile with a refresh interval through contentWindow.location.replace, which adds no session history entry, including for a cross-origin frame.
• Fall back to assigning src when the frame has no window yet.
• Refresh the cache-busting stamps.

Testing
All green. Added a test that a reload replaces the frame location and leaves src unchanged.

Changelog

Fixed

• Stop app tiles with a refresh interval from filling the browser Back history.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.