feat(rt+auth): batched input publish boi so 4 (het crackle) + auto-login loopback khong can mat khau

- fx_realtime: write_input gom FXRT_IN_SLOTS(4) frame vao _in_pending, flush
  ghi 1 lan + h.in_write += n (publish atomic -> bridge take=4 luon, het deficit)
- plugins pump: flush_input_stale(0.004) dau vong lap -> input le khong ket
- auth: _is_loopback(127.*/::1/localhost) -> get_current_user khong token = admin
  tu DB (must_change_password=False); POST /auth/local auto-login loopback, LAN 403
- ws fx-realtime: loopback khong token cho phep, remote thieu token -> close 4401
- UI: checkAuthStatus khong savedToken -> thu localLogin, thanh cong vao DAW,
  that bai -> modal login nhu cu; cache-buster v=202608212400

app/api/v1/plugins.py

@@ -11,7 +11,7 @@ from app.core.render_engine import PythonRenderEngine, _find_sf2_path, _find_def
 from app.core.soundfont_inspector import SoundFontInspector
 from app.core.soundfont_converter import SoundFontConverter
 from app.core.soundfont_scanner import SoundFontAutoScanner
-from app.api.v1.auth import get_current_user, enforce_password_changed
+from app.api.v1.auth import get_current_user, enforce_password_changed, _is_loopback
 from app.core import fx_realtime
 from app.core.auth import decode_token
 
@@ -1038,8 +1038,8 @@ async def ws_fx_realtime(websocket: WebSocket, session_id: str):
     """Vòng lặp FX realtime: receive block input → SHM → bridge → SHM → send
     block output. Binary frames: 2048B stereo float32 interleaved (256*2)."""
     # Auth: token qua query param (JS WebSocket không set header dễ) hoặc
-    # Authorization Bearer. Desktop app có thể chưa login → token rỗng được
-    # phép (endpoint /start vẫn yêu cầu auth).
+    # Authorization Bearer. Standalone (loopback) không cần token — auto admin
+    # (đồng bộ get_current_user). Client LAN thiếu token → close.
     token = websocket.query_params.get("token", "") or ""
     if not token:
         auth = websocket.headers.get("authorization", "")
@@ -1053,6 +1053,11 @@ async def ws_fx_realtime(websocket: WebSocket, session_id: str):
         if not payload:
             await websocket.close(code=4401)
             return
+    else:
+        _host = websocket.client.host if websocket.client else None
+        if not _is_loopback(_host):
+            await websocket.close(code=4401)
+            return
     sess = fx_realtime.get_session(session_id)
     if not sess:
         await websocket.close(code=4404)
@@ -1074,6 +1079,7 @@ async def ws_fx_realtime(websocket: WebSocket, session_id: str):
             _loop = asyncio.get_event_loop()
             while True:
                 try:
+                    sess.flush_input_stale()  # input lẻ kẹt trong pending → publish
                     _lats = sess.get_latencies()
                     _total = sum(_lats.values()) if _lats else 0
                     if _total != _last_lat: