feat: harden isolated Tornado test workflow

MainWindow.xaml.cs

@@ -2,6 +2,7 @@ using System.Diagnostics;
 using System.Reflection;
 using System.Runtime.InteropServices;
 using System.Text.Json;
+using MBN_STOCK_WEBVIEW.Core.Playout;
 using MBN_STOCK_WEBVIEW.Infrastructure;
 using Microsoft.UI.Windowing;
 using Microsoft.Web.WebView2.Core;
@@ -126,8 +127,7 @@ public sealed partial class MainWindow : Window
             return;
         }
 
-        if ((uri.Scheme == Uri.UriSchemeHttps &&
-             uri.Host.Equals(AppHost, StringComparison.OrdinalIgnoreCase)) ||
+        if (PlayoutBridgeProtocol.IsTrustedSource(uri.AbsoluteUri, AppHost) ||
             uri.Scheme == "about")
         {
             LoadingOverlay.Visibility = Visibility.Visible;
@@ -166,9 +166,7 @@ public sealed partial class MainWindow : Window
 
     private void OnWebMessageReceived(object? sender, CoreWebView2WebMessageReceivedEventArgs args)
     {
-        if (!Uri.TryCreate(args.Source, UriKind.Absolute, out var source) ||
-            source.Scheme != Uri.UriSchemeHttps ||
-            !source.Host.Equals(AppHost, StringComparison.OrdinalIgnoreCase))
+        if (!PlayoutBridgeProtocol.IsTrustedSource(args.Source, AppHost))
         {
             return;
         }