fix(forms): accept HIPAA Jotform completion origin

www/src/utils/jotform-completion.ts

@@ -6,7 +6,17 @@ export function isFormACompletion(event: { origin: string; source: unknown; data
   // never from the message, current child location, query string or referrer.
   let expected: URL;
   try { expected = new URL(approvedUrl); } catch { return false; }
-  if (expected.protocol !== 'https:' || event.origin !== expected.origin) return false;
+  if (expected.protocol !== 'https:') return false;
+
+  // HIPAA-enabled Jotform submissions can send completion messages
+  // from a different origin than the original embedded form.
+  const approvedOrigins = new Set([expected.origin]);
+
+  if (expected.origin === 'https://form.jotform.com') {
+    approvedOrigins.add('https://hipaa-submit.jotform.com');
+  }
+
+  if (!approvedOrigins.has(event.origin)) return false;
   let data = event.data;
   if (typeof data === 'string') {
     if (data.length > 4096) return false;