fix: allow comfyui assets through proxy

src/routes/comfy_proxy.rs

@@ -5,9 +5,8 @@
 //! looks up the per-user container in [`ComfyUIPool`], and forwards
 //! both HTTP and WS traffic to that container's loopback port.
 //!
-//! NO path rewriting on the response — ComfyUI's HTML/JS reference
-//! root-relative URLs which the browser will request under `/comfy/...`,
-//! and the path stripping done here lines them up with the upstream.
+//! The proxy strips `/comfy` on requests so ComfyUI can keep serving from
+//! its normal root while browsers see a scoped iframe URL.
 
 use std::sync::Arc;
 use std::time::{Duration, Instant};
@@ -222,7 +221,7 @@ async fn forward_http(
 
     let mut rb = client.request(reqwest_method(&parts.method), upstream.to_string());
     for (name, value) in parts.headers.iter() {
-        if is_hop_by_hop(name) {
+        if is_hop_by_hop(name) || is_browser_context_header(name) {
             continue;
         }
         if let Ok(v) = value.to_str() {
@@ -278,6 +277,16 @@ fn is_hop_by_hop(name: &HeaderName) -> bool {
         || name.as_str().eq_ignore_ascii_case("keep-alive")
 }
 
+fn is_browser_context_header(name: &HeaderName) -> bool {
+    let name = name.as_str();
+    name.eq_ignore_ascii_case("origin")
+        || name.eq_ignore_ascii_case("referer")
+        || name.eq_ignore_ascii_case("sec-fetch-site")
+        || name.eq_ignore_ascii_case("sec-fetch-mode")
+        || name.eq_ignore_ascii_case("sec-fetch-dest")
+        || name.eq_ignore_ascii_case("sec-fetch-user")
+}
+
 // ── WebSocket forwarder ────────────────────────────────────────────────
 
 async fn ws_handler(