fix(chat): close credential leaks and harden the chat route

- Vertex: a client-supplied base URL only works with the client's own Vertex key
- Accept only data: URLs for file parts in every message, so the server never downloads them
- Output budget retry accounts for the thinking budget Bedrock/Anthropic add, and reads
  Volcengine, DashScope, SGLang and vLLM rejections; falls back to 16000 once
- x-max-output-tokens can only lower the budget on server credentials
- On server credentials only server models or AI_MODEL entries can be used
- Drop tool results together with the invalid tool calls they belong to
- Count quota tokens as input + output (cached tokens were counted twice)
- Private-URL check for custom base URLs, end Langfuse traces on error/abort/early return
- Fix repairToolCall ordering and placeholder, align edit_diagram prompt with operations
- Panel Bedrock keys are read from ADMIN_AWS_*; forward the access code to EdgeOne
- isMinimalDiagram only treats root cells as an empty canvas

lib/access-code.ts

@@ -0,0 +1,22 @@
+/**
+ * Check the x-access-code header against ACCESS_CODE_LIST.
+ * Returns a 401 response to send back when the check fails, or null when the
+ * request may continue (including when no access codes are configured).
+ */
+export function checkAccessCode(req: Request): Response | null {
+    const accessCodes =
+        process.env.ACCESS_CODE_LIST?.split(",")
+            .map((code) => code.trim())
+            .filter(Boolean) || []
+    if (accessCodes.length === 0) return null
+
+    const accessCodeHeader = req.headers.get("x-access-code")
+    if (accessCodeHeader && accessCodes.includes(accessCodeHeader)) return null
+
+    return Response.json(
+        {
+            error: "Invalid or missing access code. Please configure it in Settings.",
+        },
+        { status: 401 },
+    )
+}