Maintainer ruling: drop the local-only gate on the reveal route, like LoRA Manager.
The route stays POST, JSON and same-origin, comparing Origin with X-Forwarded-Host
or Host and with X-Forwarded-Proto or the socket's scheme, and keeps its path check.
Remove is_local_request, which had no other caller.