fix: prevent SSRF attack via custom base URL (GHSA-9qf7-mprq-9qgm)

Require API key when custom base URL is provided to prevent attackers
from redirecting server API keys to malicious endpoints.

CVSS: 9.3 (Critical)

package.json

@@ -1,6 +1,6 @@
 {
     "name": "next-ai-draw-io",
-    "version": "0.4.1",
+    "version": "0.4.2",
     "license": "Apache-2.0",
     "private": true,
     "scripts": {