docs: describe an empty allowlist as unset in the frontend comments

frontend/src/lib/components/triggers/http/RouteEditorInner.svelte

@@ -124,7 +124,7 @@
 	// Derived from the stored list, not reported by the field: the field only
 	// exists on the request-options tab, so an error owned by it would keep Save
 	// disabled from a screen that cannot show why. An empty list is not an error
-	// at all, it is the deny-every-origin state, so only what the API refuses
+	// either, since it resolves as an unset one, so only what the API refuses
 	// blocks the save.
 	const originsError = $derived(allowedOriginsError(allowed_origins))
 	// Fetched once here rather than in RouteCorsOption so the Advanced badge can

frontend/src/lib/components/triggers/http/utils.ts

@@ -49,11 +49,12 @@ export const MAX_ALLOWED_ORIGIN_LEN = 256
 /**
  * The first entry the API would refuse, if any. Derived from the stored list
  * rather than the field, so it stays correct while the editor is on another tab
- * and the field is not mounted. An empty list is not an error here: it is the
- * deny-every-origin state the backend accepts.
+ * and the field is not mounted. An empty list is not an error: it resolves as an
+ * unset one, so there is nothing in it to refuse.
  *
- * A comma never reaches this: it is the field's separator, so an entry cannot
- * carry one in the first place.
+ * A comma-bearing entry does reach this, through the settings path where a list
+ * can be given as an array. It cannot arrive from the origins field, which
+ * splits on commas before this ever sees it.
  */
 export function allowedOriginsError(allowed_origins: string[] | undefined): string | undefined {
 	if (allowed_origins !== undefined && allowed_origins.length > MAX_ALLOWED_ORIGINS)