Mirror ComfyUI-Manager's local mode: setting or deleting API keys,
installing LUTs and switching the LUT catalog channel are accepted only
when every ComfyUI listen address and the request's socket peer are
loopback addresses. Forwarded headers are ignored. Operators of a
--listen server opt in through admin_settings.json in BV's private
storage; that is a deliberate opening, not an authentication. Read
routes and the fixed-source catalog refresh stay open, and the provider
and LUT status responses report the management state for the UI.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>