Local folder jobs are now refused with 403 unless the server runs with SHOW_LOCAL=true, and job kinds other than local or github are rejected. /api/health reports localFolders so the frontend can hide the option. Tests enable it explicitly where they index local folders.