fix(system): no existence oracle in source validation

A gallery root's containment in the allowed ComfyUI folders is now
decided before its existence and type, so a path outside them answers
"outside-allowed" whether or not it exists. validate-source also folds
the filesystem-root and home-directory codes into "outside-allowed", with
one reason, and logs the detail server-side only. Paths inside the
allowed folders still say "not-found" or "not-directory". The legacy
settings save shares the same check.

py/api/sources.py

@@ -17,10 +17,13 @@ process has no monitor; else ``restart_pending`` (a source added since the
 monitor started, monitoring switched on, or an observer that stopped).
 """
 
+import logging
 import ntpath
 import os
 import re
 
+logger = logging.getLogger("prompt_manager.api")
+
 MAX_SOURCE_PATH = 4096  # characters
 FORM_REASONS = {
     "empty": "Gallery root must be a non-empty path",
@@ -38,6 +41,12 @@ _COMFYUI_LABELS = (
     ("get_temp_directory", "ComfyUI temp"),
     ("get_user_directory", "ComfyUI user"),
 )
+# Codes validate-source folds into "outside-allowed" (see validate_source).
+_OUTSIDE_CODES = frozenset({"filesystem-root", "home-directory", "outside-allowed"})
+OUTSIDE_REASON = (
+    "Gallery root must be inside a ComfyUI directory (output, input, temp, user) "
+    "or one listed in PROMPT_MANAGER_EXTRA_GALLERY_ROOTS"
+)
 WATCH_STATES = ("watching", "manual", "restart_pending")
 
 
@@ -217,6 +226,12 @@ def validate_source(text):
     reason = FORM_REASONS.get(code)
     if code is None:
         code, reason = GalleryConfig.gallery_root_problem(text)
+        if code in _OUTSIDE_CODES:
+            # One answer for every path outside the allowed folders: naming
+            # the filesystem root or the home directory would let a caller
+            # probe the server's layout. The detail goes to the log only.
+            logger.info(f"Source refused: {code}")
+            code, reason = "outside-allowed", OUTSIDE_REASON
     if code is not None:
         return {
             "valid": False,