fix(security): register extension.manager.supports_csrf_post feature flag (4.2.1)

Expose CSRF-POST backend capability as a semantic contract via ComfyUI core's
feature_flags mechanism, so frontends (ComfyUI_frontend, extensions) can detect
it without parsing version strings. Pre-4.2.1 Manager does not set the flag —
clients observe its absence and should treat the backend as "incompatible with
POST-only state-mutation endpoints" and prompt the user to upgrade.

Follow-up patch to 4.2 (PR #2818); no endpoint or security behavior change.

Reported-by: XlabAI Team of Tencent Xuanwu Lab
CVSS: 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)

comfyui_manager/__init__.py

@@ -6,6 +6,25 @@ from .common import manager_security
 from comfy.cli_args import args
 
 
+# Register server-push feature flag so frontends (ComfyUI_frontend) can
+# detect CSRF-POST backend capability as a semantic contract (vs version
+# string parsing). See PR #2818 for context; cmfront uses this flag to
+# decide whether to invoke POST state-mutation endpoints. Pre-4.2.1 Manager
+# does not set this flag — cmfront treats its absence as 'incompatible'.
+try:
+    from comfy_api import feature_flags as _core_feature_flags
+    _mgr_flags = (
+        _core_feature_flags.SERVER_FEATURE_FLAGS
+        .setdefault('extension', {})
+        .setdefault('manager', {})
+    )
+    _mgr_flags['supports_csrf_post'] = True
+except ImportError:
+    # Older ComfyUI core without comfy_api.feature_flags module.
+    # Manager functions but cmfront will not observe the flag.
+    pass
+
+
 def prestartup():
     from . import prestartup_script  # noqa: F401
     logging.info('[PRE] ComfyUI-Manager')