merge #69: probe embed signals via GET fallback when HEAD omits them (trinhthiminh650-tech)

# Conflicts:
#	src/client/builtins/tabs.tsx
#	src/client/locales.ts
#	src/client/prefs.ts
#	src/config.ts
#	src/index.ts
#	src/prefs-shared.ts

src/prefs-shared.ts

@@ -175,6 +175,16 @@ export interface SidebarPrefs {
    * tab's own enable switch.
    */
   browserInterceptHttps: boolean
+  /**
+   * Comma-separated allowlist of local (loopback) authorities the browser
+   * tab may navigate to — `localhost`, `127.0.0.1`, `127.0.0.1:5174`, or
+   * host:port pairs. Empty by default: loopback addresses stay blocked so a
+   * browsed page cannot probe local services. Each entry is either a bare
+   * hostname (all ports) or host:port; the GUI's own origin is always
+   * allowed regardless. The iframe sandbox still renders allowed local
+   * pages in an opaque origin, exactly like any other site.
+   */
+  browserAllowedLoopback: string
   /**
    * Per-tab enable switches, keyed by tab descriptor id (`'explorer'`,
    * `'my-plugin:db'`). An ABSENT key means enabled — only an explicit
@@ -247,6 +257,7 @@ export const SIDEBAR_PREFS_DEFAULTS: SidebarPrefs = {
   browserInterceptLinks: true,
   browserInterceptHttp: true,
   browserInterceptHttps: false,
+  browserAllowedLoopback: '',
   tabsEnabled: {},
   viewersEnabled: {},
   pluginSettings: {},