Landing page: external links open in a new tab

External links on the landing page (Get API key, Decision API, MoM, Models, explore tiles) did nothing on the Space.

**Cause:** they used `target="_top"`, which navigates the page around the app. A Space's iframe sandbox allows popups but not top navigation (no `allow-top-navigation`), so the browser blocked every click.

**Fix:** external links open in a new tab (`target="_blank" rel="noopener noreferrer"`). The receipt and returns demos are on the same origin, so they still open inside the Space frame as before. Visitors can get a key in the new tab and paste it back into the landing page.

**Tested locally** with the Space's iframe sandbox attributes copied exactly:
- before: all 12 external links blocked
- after: all 12 open in a new tab, the Space page stays, both demos open in the frame with the key handed over
- e2e through the gateway with a real key: all pass

Only the landing page build changes (`landing/index.html`, new JS bundle, `SOURCES.txt`). Dockerfile is unchanged (already has `chmod +x start.sh`).

Separate note: "Check key" will keep failing while the Space is private (HF's proxy returns 404 to the key check, which is sent without the sign-in cookie). It works once the Space is public.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

SOURCES.txt

@@ -1,3 +1,3 @@
-landing 9c37c6f
+landing 6a05f0e
 receipt 4efcb13
 returns 2cbd87e

landing/index.html

@@ -26,7 +26,7 @@
     document.documentElement.dataset.theme = t;
   })();
 </script>
-  <script type="module" crossorigin src="./assets/index-GTbNYANO.js"></script>
+  <script type="module" crossorigin src="./assets/index-ixuRHQfC.js"></script>
   <link rel="stylesheet" crossorigin href="./assets/index-BxK2WchK.css">
 </head>
 <body>