fix(models): import upload and Tidy moves only from this computer

PUT /anomalous/import/upload and POST /anomalous/placement/move wrote
into the model folders for any caller, while place and identify already
answered only the computer ComfyUI runs on. With ComfyUI started with
--listen, another device could upload model files or move models
between folders. Both now check mcp_server._is_local first and answer
403 not_local, which the import and Tidy screens already show.

Tests drive both routes through a proxy header and check nothing was
written or moved; they fail without the check. Full suite: structure
check, every tests/*.mjs and 234 Python tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018P2T2R7TFbJsc3C9maCD8B

api/model_import.py

@@ -12,6 +12,7 @@ POST /anomalous/import/identify {token} -> its SHA-256, what Civitai knows of it
 POST /anomalous/import/place {token, type, root, rel, keep} -> moves that file there (a copy
     when `keep`); same drive = a rename, another drive = copy, then the original goes.
 PUT  /anomalous/import/upload?type&root&rel&size  body: the whole file -> written there.
+identify, place and upload answer only the computer ComfyUI runs on (mcp_server._is_local).
 
 A file already at the destination is never replaced: the new one gets " (2)". Each import is
 one activity log entry (model_import).
@@ -352,6 +353,8 @@ async def api_place(request):
 
 
 async def api_upload(request):
+    if not _is_local(request):
+        return _error("not_local", 403)
     try:
         size = int(request.query.get("size") or 0)
         folder_type, root_index, root, dest = await asyncio.to_thread(destination, dict(request.query), size)

api/model_placement.py

@@ -9,7 +9,8 @@ GET  /anomalous/placement/check[?deep=1] -> {misplaced, duplicates, unchecked}
     the same size (small ones always, large ones with deep). unchecked: the same-size large
     files a deep check would still read.
 POST /anomalous/placement/move {type, root, rel, to_type, to_root, to_rel} -> moves a model
-    and its sidecars (covers, info, the user's notes); never over a file (" (2)").
+    and its sidecars (covers, info, the user's notes); never over a file (" (2)"). Only for
+    the computer ComfyUI runs on (mcp_server._is_local).
 
 Removing a copy goes through /anomalous/delete_model (Recycle Bin). Headers and computed
 SHA-256s are kept in memory per file (path, size, time).
@@ -30,6 +31,7 @@ except ImportError:  # loaded outside the package (tests)
     from model_identity import file_sha256
     from model_kind import inspect_file
 from .activity_log import add_entry
+from .mcp_server import _is_local
 from .metadata import get_metadata
 from .model_constants import MEDIA_EXTENSIONS, PREVIEW_SUFFIXES, SIDECAR_SUFFIXES
 from .model_download import MODEL_EXTENSIONS, clean_folder, forget_file_lists
@@ -248,6 +250,8 @@ async def api_check(request):
 
 
 async def api_move(request):
+    if not _is_local(request):
+        return web.json_response({"error": "not_local"}, status=403)
     try:
         data = await request.json()
         if not isinstance(data, dict):