fix(server): count quota by the key actually used, and more review fixes

Found by the PR review, each with a test that failed first:
- Quota: any key header skipped it, even one the provider never reads
  (x-aws-access-key-id with OpenAI), so a request ran on the server's
  key without being counted. The check now runs after the model is
  resolved and uses usesServerCredentials. On main already.
- usesServerCredentials read the raw base URL; "/" cleans up to none, so
  an Ollama request ran on the server's key past the server-model check.
- SGLang's default 127.0.0.1:8000 only fills the settings form. Chat and
  the model list used it as a real address, so the server called its own
  machine even with private URLs blocked. Now a base URL is required.
- With a user's OpenAI key and no base URL, the SDK read the server's
  OPENAI_BASE_URL. The official endpoint is now passed. On main already.
- The Test button refused nothing on the server's keys (Ollama Cloud),
  and a 15 s timeout reported "connected, no tool call".
- The model list for Ollama without a base URL came from ollama.com while
  chat went to the server's Ollama.
- Bedrock's "Too many tokens, please wait" counted as context too long.
- On the server's keys the provider's error text stays in the server log;
  it can name the server's AWS account, role or internal hosts.
- Desktop app: the preset keys are the user's own (NEXT_AI_DRAWIO_DESKTOP),
  so Max Output Tokens can be raised and keyless models in settings work
  again. A launch that found the remembered port taken no longer replaces
  it, which hid the user's chats and settings for good.

lib/ai-providers.ts

@@ -682,7 +682,8 @@ function createModel(
             // A custom base URL is usually a proxy that only has Chat
             // Completions; the official endpoint uses the Responses API,
             // which returns reasoning for the o-series and gpt-5 or later
-            return e.baseURL
+            return e.baseURL &&
+                e.baseURL !== PROVIDER_INFO.openai.defaultBaseUrl
                 ? openaiProvider.chat(modelId)
                 : openaiProvider(modelId)
         }
@@ -994,14 +995,28 @@ export function getAIModel(clientOverrides?: ClientOverrides): ModelConfig {
                 provider === "gateway"
                     ? "AI_GATEWAY_BASE_URL"
                     : `${provider.toUpperCase()}_BASE_URL`
+            // A local default (SGLang's 127.0.0.1) only fills the settings
+            // form; the server must not call its own machine for it. With a
+            // user's key the OpenAI SDK would read the server's
+            // OPENAI_BASE_URL, so name the official endpoint.
+            const defaultUrl = PROVIDER_INFO[provider].defaultBaseUrl
+            const publicDefault = defaultUrl?.startsWith("https://")
+                ? defaultUrl
+                : undefined
             const baseURL = resolveBaseURL(
                 overrides?.apiKey,
                 overrides?.baseUrl,
                 resolveBaseUrlEnv(overrides, baseUrlEnv),
-                SDK_KNOWS_ENDPOINT.has(provider)
+                SDK_KNOWS_ENDPOINT.has(provider) &&
+                    !(provider === "openai" && overrides?.apiKey)
                     ? undefined
-                    : PROVIDER_INFO[provider].defaultBaseUrl,
+                    : publicDefault,
             )
+            if (!baseURL && !SDK_KNOWS_ENDPOINT.has(provider)) {
+                throw new Error(
+                    `${PROVIDER_INFO[provider].label} needs a base URL. Add it in the model settings.`,
+                )
+            }
             model = createModel(provider, modelId, {
                 apiKey,
                 baseURL,
@@ -1032,6 +1047,10 @@ export function usesServerCredentials(
     provider: ProviderName,
     overrides?: ClientOverrides,
 ): boolean {
+    // The desktop app's local server holds the user's own preset keys
+    if (process.env.NEXT_AI_DRAWIO_DESKTOP === "1") return false
+    // Cleaned like getAIModel does: "/" means no base URL
+    const baseUrl = normalizeBaseUrl(overrides?.baseUrl ?? "")
     switch (provider) {
         case "bedrock":
             return !(overrides?.awsAccessKeyId && overrides?.awsSecretAccessKey)
@@ -1044,7 +1063,7 @@ export function usesServerCredentials(
             // Only a server key costs money; a keyless local server or the
             // client's own server does not
             return (
-                !overrides?.baseUrl &&
+                !baseUrl &&
                 !overrides?.apiKey &&
                 !!(overrides?.apiKeyEnv || process.env.OLLAMA_API_KEY)
             )

lib/llm-errors.ts

@@ -36,7 +36,8 @@ export interface LLMError {
 // error can come as 403 or 429, a context or image error as a plain 400
 const SPECIFIC_TEXTS: Array<[RegExp, LLMErrorCode]> = [
     [
-        /context length|context window|maximum context|prompt is too long|input is too long|too many (?:input )?tokens/i,
+        // Not "too many tokens": that is Bedrock's throttling message
+        /context length|context window|maximum context|prompt is too long|input is too long|too many input tokens/i,
         "context_too_long",
     ],
     [
@@ -110,12 +111,19 @@ function problemDetail(body: string): string | undefined {
 /**
  * The error text for the chat stream: what went wrong with the provider as
  * JSON for the hint, or the text the model must read to fix a tool call.
+ * On the server's keys the provider's own text stays in the server log:
+ * it can name the server's account, role or internal hosts.
  */
-export function streamErrorText(error: unknown): string {
+export function streamErrorText(error: unknown, hideDetails = false): string {
     // The SDK passes an invalid tool call's error as a plain string
     if (typeof error === "string") return error
     if (isToolCallError(error)) return (error as Error).message
-    return JSON.stringify(classifyLLMError(error))
+    const classified = classifyLLMError(error)
+    if (hideDetails) {
+        console.error("[chat] Provider error:", error)
+        classified.message = "The provider returned an error."
+    }
+    return JSON.stringify(classified)
 }
 
 /**

lib/provider-models.ts

@@ -75,6 +75,19 @@ async function getJson(
     return response.json()
 }
 
+/**
+ * Where to list from without the user's base URL: where chat goes then. For
+ * Ollama that is the server's Ollama, else the SDK's local default; a local
+ * default in PROVIDER_INFO (SGLang's) only fills the settings form.
+ */
+function listFallbackUrl(provider: ProviderName): string {
+    if (provider === "ollama") {
+        return process.env.OLLAMA_BASE_URL || "http://127.0.0.1:11434/api"
+    }
+    const url = PROVIDER_INFO[provider].defaultBaseUrl
+    return url?.startsWith("https://") ? url : ""
+}
+
 /**
  * The provider's chat models, with tool support from the provider's own
  * data or else models.dev. Only the client's key is used, so the server's
@@ -85,9 +98,7 @@ export async function listProviderModels(
     { apiKey, baseUrl }: { apiKey?: string; baseUrl?: string },
     fetchFn: typeof fetch = fetch,
 ): Promise<ListedModel[]> {
-    const base = normalizeBaseUrl(
-        baseUrl || PROVIDER_INFO[provider].defaultBaseUrl || "",
-    )
+    const base = normalizeBaseUrl(baseUrl || listFallbackUrl(provider))
     const bearer: Record<string, string> = apiKey
         ? { Authorization: `Bearer ${apiKey}` }
         : {}
@@ -170,6 +181,11 @@ export async function listProviderModels(
             break
         }
         default: {
+            if (!base) {
+                throw new Error(
+                    `${PROVIDER_INFO[provider].label} needs a base URL to list its models.`,
+                )
+            }
             const data = await getJson(`${base}/models`, bearer, fetchFn)
             models = (data.data ?? [])
                 .map((m: { id: string }) => ({ id: m.id }))