fix(widget): gate http localhost to dev in sandbox origin check

[BlackPool25]

Summary

Gate http for localhost/127.0.0.1 in public/wm-widget-sandbox.html to dev only (window.location.protocol === 'http:'). In production the sandbox is served over https, so http://127.0.0.1:* -> false. https://127.0.0.1 still allowed, https://evil.com -> false unchanged.

src/utils/widget-sanitizer.ts:154 keeps '*' with existing comment — iframe is sandbox="allow-scripts" without allow-same-origin (opaque origin), so '*' is required for delivery; gating is done via isAllowedParentOrigin + per-widget id/token + event.source check.

Type of change

• Bug fix

Affected areas

• Map / Globe
• News panels / RSS feeds
• AI Insights / World Brief
• Market Radar / Crypto
• Desktop app (Tauri)
• API endpoints (/api/*)
• Config / Settings
• Other: widget sandbox

Checklist

• No API keys or secrets committed
• TypeScript compiles without errors
• Tested via grep -n isAllowedParentOrigin public/wm-widget-sandbox.html and node -e for http://127.0.0.1:8787 (dev true, prod false)

Closes #7055

Verification

grep -n "isAllowedParentOrigin" public/wm-widget-sandbox.html -A 6
node -e "function isAllowedParentOrigin(o){let u=new URL(o);let lh=u.hostname==='127.0.0.1';if(lh){if(u.protocol==='https:')return true; if(u.protocol==='http:'&&'https:'==='http:')return true; return false} return false} console.log(isAllowedParentOrigin('http://127.0.0.1:8787'))" # → false in prod

[vercel]

@BlackPool25 is attempting to deploy a commit to the World Monitor Team on Vercel.

A member of the Team first needs to authorize it.