fix(webui): tighten localhost bootstrap check

nanobot/webui/ws_http.py

@@ -45,6 +45,9 @@ from nanobot.webui.http_utils import (
 from nanobot.webui.http_utils import (
     http_response as _http_response,
 )
+from nanobot.webui.http_utils import (
+    is_local_browser_request as _is_local_browser_request,
+)
 from nanobot.webui.http_utils import (
     is_localhost as _is_localhost,
 )
@@ -306,14 +309,14 @@ class GatewayHTTPHandler:
 
     def _handle_bootstrap(self, connection: Any, request: Any) -> Response:
         secret = self.config.token_issue_secret.strip() or self.config.token.strip()
-        is_local = _is_localhost(connection)
+        is_local_browser = _is_local_browser_request(connection, request.headers)
         if secret:
             if not _issue_route_secret_matches(request.headers, secret):
                 return _http_error(401, "Unauthorized")
-        elif not is_local:
+        elif not is_local_browser:
             return _http_error(403, "bootstrap is localhost-only")
 
-        api_token_allowed = bool(secret) or is_local
+        api_token_allowed = bool(secret) or is_local_browser
         if not self.tokens.can_issue(include_api_token=api_token_allowed):
             return _http_response(
                 json.dumps({"error": "too many outstanding tokens"}).encode("utf-8"),