Manager allows for localhost to call maanger endpoints and execute any custom node installation - anything we can do about that?

With desktop (standalone installs), if we can somehow make the electron app be the only way to make manager calls go through, that would be a massive security boon - otherwise, a website could attempt to execute known localhost comfy port stuff to install custom nodes/cause remote code execution due to the unsecure custom nodes (which may be of git origina and not part of custom node registry).

Start by tracing how the Electron app makes manager calls to the localhost Comfy port, including custom-node installation requests. Determine how a website can reach these endpoints and define a verified restriction that leaves the Electron app functional while preventing unauthorized manager actions and remote code execution.

Written by the indexing model from the issue text.