fix(server): count quota by the key actually used, and more review fixes

Found by the PR review, each with a test that failed first:
- Quota: any key header skipped it, even one the provider never reads
  (x-aws-access-key-id with OpenAI), so a request ran on the server's
  key without being counted. The check now runs after the model is
  resolved and uses usesServerCredentials. On main already.
- usesServerCredentials read the raw base URL; "/" cleans up to none, so
  an Ollama request ran on the server's key past the server-model check.
- SGLang's default 127.0.0.1:8000 only fills the settings form. Chat and
  the model list used it as a real address, so the server called its own
  machine even with private URLs blocked. Now a base URL is required.
- With a user's OpenAI key and no base URL, the SDK read the server's
  OPENAI_BASE_URL. The official endpoint is now passed. On main already.
- The Test button refused nothing on the server's keys (Ollama Cloud),
  and a 15 s timeout reported "connected, no tool call".
- The model list for Ollama without a base URL came from ollama.com while
  chat went to the server's Ollama.
- Bedrock's "Too many tokens, please wait" counted as context too long.
- On the server's keys the provider's error text stays in the server log;
  it can name the server's AWS account, role or internal hosts.
- Desktop app: the preset keys are the user's own (NEXT_AI_DRAWIO_DESKTOP),
  so Max Output Tokens can be raised and keyless models in settings work
  again. A launch that found the remembered port taken no longer replaces
  it, which hid the user's chats and settings for good.

tests/unit/llm-errors.test.ts

@@ -110,6 +110,14 @@ describe("classifyLLMError", () => {
         expect(classifyLLMError(error).code).toBe("model_not_found")
     })
 
+    it("reads Bedrock's token throttling as a rate limit", () => {
+        const error = apiError(
+            429,
+            "Too many tokens, please wait before trying again.",
+        )
+        expect(classifyLLMError(error).code).toBe("rate_limited")
+    })
+
     it("names a network error the SDK wrapped", () => {
         const error = new APICallError({
             message:
@@ -201,6 +209,19 @@ describe("streamErrorText", () => {
         }
     })
 
+    it("hides the provider's text on the server's keys", () => {
+        const error = apiError(
+            403,
+            "User: arn:aws:sts::123456789012:assumed-role/app/s is not authorized to perform: bedrock:InvokeModel",
+        )
+        const hidden = JSON.parse(streamErrorText(error, true))
+        expect(hidden.code).toBe("forbidden")
+        expect(hidden.message).not.toMatch(/arn:aws|123456789012/)
+        expect(JSON.parse(streamErrorText(error)).message).toMatch(
+            /not authorized/,
+        )
+    })
+
     it("classifies a provider error", () => {
         expect(JSON.parse(streamErrorText(apiError(401, "bad key")))).toEqual({
             type: "provider",