GeminiNanoBanana2 (ComfyAPI nodes) returns "Unauthorized" when workflow is submitted via API, but works fine in Web UI

### Feature Idea

Body:

Description

When submitting a workflow containing GeminiNanoBanana2 nodes via the ComfyUI API (POST /prompt), the node throws Unauthorized: Please login first to use this node. The same workflow works correctly when executed through the Web UI.

Environment

• ComfyUI: 0.17.2
• Python: 3.13.11
• OS: Windows 11
• PyTorch: 2.10.0+cu130
• Node: GeminiNanoBanana2 (Nano Banana 2 / Gemini 3.1 Flash Image)
• Auth: ComfyUI API key is configured and works for /system_stats and /prompt endpoints

Steps to Reproduce

1. Create a workflow with a GeminiNanoBanana2 node and a LoadImage node
2. Log in to ComfyUI account via Web UI (able to run the workflow successfully in browser)
3. Upload the input image via POST /upload/image
4. Submit the workflow via POST /prompt (with or without Authorization: Bearer header)
5. The node errors with "Unauthorized"

Expected Behavior

API-submitted workflows should authenticate with [comfyapi.com](http://comfyapi.com/) using the same credentials as the Web UI, or provide a way to configure the ComfyAPI auth token/API key that persists across API calls.

Root Cause Analysis

The authentication header for [comfyapi.com](http://comfyapi.com/) requests is built in comfy_api_nodes/util/_helpers.py:

def get_auth_header(node_cls):
if node_cls.hidden.auth_token_comfy_org:
return {"Authorization": f"Bearer {node_cls.hidden.auth_token_comfy_org}"}
if node_cls.hidden.api_key_comfy_org:
return {"X-API-KEY": node_cls.hidden.api_key_comfy_org}
return {}

The node_cls.hidden object appears to only be populated when the node is first initialized through the Web UI frontend. When the workflow is submitted via API, hidden.auth_token_comfy_org and hidden.api_key_comfy_org are both None, so no auth header is sent to [comfyapi.com](http://comfyapi.com/).

Suggested Fix

1. Allow configuring auth_token_comfy_org or api_key_comfy_org via an environment variable (e.g., COMFY_API_KEY) or a config file, so API-only workflows can authenticate without browser session
2. Or persist the auth state server-side after Web UI login so subsequent API calls inherit it

### Existing Solutions

_No response_

### Other

_No response_