Security-policy override via unsigned strategy payloads

RustDesk Client 1.4.8 and earlier allows attackers to override local security settings through a subverted API channel. The strategy merge loop accepts unsigned config_options from the configured API heartbeat and passes them to Config::set_options(), which applies strategy values above user settings and ignores the local remote-modification toggle. Exploitation requires plaintext HTTP, a compromised or rogue API endpoint, client re-homing, or nondefault insecure TLS fallback; it can clear whitelists or enable full control, file transfer, terminal, and other restricted features.