feat(browser): loopback allowlist with same-origin for local dev servers

Add a side-card preference 'browserAllowedLoopback' (comma-separated
host or host:port entries) that lets the sidebar browser navigate to
explicitly trusted loopback addresses. Bare hosts (localhost,
127.0.0.1) match every port; host:port entries match exactly.

Allowlisted local addresses additionally get the 'allow-same-origin'
sandbox token in the iframe: local dev servers (Vite etc.) need a real
origin for their module/HMR/fetch pipeline and would otherwise render
blank in the opaque-origin sandbox. The page stays cross-origin to the
GUI and to every other site.

The server-side browser.probe route mirrors the same allowlist so
probed local servers are not rejected as 'local addresses are not
probed'.

src/prefs-shared.ts

@@ -92,6 +92,16 @@ export interface SidebarPrefs {
    * bypasses the takeover.
    */
   browserInterceptLinks: boolean
+  /**
+   * Comma-separated allowlist of local (loopback) authorities the browser
+   * tab may navigate to — `localhost`, `127.0.0.1`, `127.0.0.1:5174`, or
+   * host:port pairs. Empty by default: loopback addresses stay blocked so a
+   * browsed page cannot probe local services. Each entry is either a bare
+   * hostname (all ports) or host:port; the GUI's own origin is always
+   * allowed regardless. The iframe sandbox still renders allowed local
+   * pages in an opaque origin, exactly like any other site.
+   */
+  browserAllowedLoopback: string
   /**
    * Per-tab enable switches, keyed by tab descriptor id (`'explorer'`,
    * `'my-plugin:db'`). An ABSENT key means enabled — only an explicit
@@ -145,6 +155,7 @@ export const SIDEBAR_PREFS_DEFAULTS: SidebarPrefs = {
   htmlViewerDefaultUnsafe: false,
   browserNoSandbox: false,
   browserInterceptLinks: true,
+  browserAllowedLoopback: '',
   tabsEnabled: {},
   viewersEnabled: {},
   pluginSettings: {},