fix(auto-loader): stop false "missing model" error on saved workflows

QuantFuncModelAutoLoader (and the prequant / precision-config / base-model
loaders) reported "缺少所需模型 / missing model" and red-noded on workflow
load even when the model was already downloaded, blocking the queue.

Root causes & fixes:
- model_auto_loader: _build_dropdown listed only the remote ModelScope
  catalog cache (refreshed in a background thread that races the /object_info
  fetch), never local files. Merge locally-downloaded files (_list_local_
  resource_names) so a present model is always a valid combo option
  regardless of network / cache-refresh timing / OS.
- web/quantfunc.js: the transformer series-filter ran only at nodeCreated,
  which fires BEFORE configure() restores saved widget values, so options
  stayed narrowed to the default series and the restored value was flagged
  missing. Re-filter on onConfigure and never drop the current value.
- nodes: give the 4 catalog-driven loaders a per-node VALIDATE_INPUTS that
  skips ComfyUI's "Value not in list" check for ONLY their catalog combo
  (static model_series / data_source stay validated); value is resolved at
  run time.
- harden: _assert_within() rejects path traversal in the download paths now
  that those combos skip combo validation (per-series base for transformer/
  prequant/precision; models dirs for the base-model downloads).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>