[xiaodoudou]

Addresses the four suggestions on Comfy-Org/ComfyUI-Manager#3344:

• Snapshot list/read check the workflow's folder role even with no live room
• Websocket join checks access before creating or seeding a room (only editors open new rooms)
• norm() refuses colon / trailing dot or space / 8.3 segments instead of dropping them (403 from routes)
• Login redirect follows next only when same-origin

Tests added for the room-less access cases; norm tests updated to expect refusal.