Maintainer ruling: drop the local-only gate on the reveal route, like LoRA Manager. The route stays POST, JSON and same-origin, comparing Origin with X-Forwarded-Host or Host and with X-Forwarded-Proto or the socket's scheme, and keeps its path check. Remove is_local_request, which had no other caller.