fix(security): check request sources, regions and endpoints

- Bedrock: a request's AWS region must be a region name. It becomes part
  of the endpoint's host name, so a value such as
  "us-east-1.attacker.example/" sent the server's bearer token or signed
  request to another host.
- MCP preview server: only the preview page itself (Origin equal to the
  Host) or a non-browser client may call it; a page on another localhost
  port could replace the diagram with a plain text POST. History builds
  its thumbnails element by element and shows only SVG data images, so a
  stored value can no longer run script in the preview.
- chat, validate-model, validate-diagram, provider-models and parse-url
  take JSON bodies only, so another website cannot make the user's own
  server (the desktop app, a local install) run models with their keys;
  the desktop app also refuses a foreign Host (DNS rebinding).
- The model list reads at most 2 MB, also through the Gateway SDK, and
  answers only with its own error texts: the URL is the caller's and may
  be an internal address.
- An admin panel provider with its own key and no URL no longer inherits
  the global <P>_BASE_URL, which may be a proxy for another key; OpenAI
  then gets the official endpoint, as its Test. Azure keeps the server's
  resource.

lib/admin/providers.ts

@@ -213,12 +213,17 @@ export function adminProvidersToConfig(
         indexByProvider.set(p.provider, index + 1)
         if (p.models.length === 0) continue
         const env = credEnvNames(p.provider, index)
+        // An entry with its own key also names its own URL variable, unset
+        // when the URL is empty: the global <P>_BASE_URL may be a proxy for
+        // another key, and the Test used the official endpoint. An Azure
+        // key belongs to one resource, so it keeps the server's.
+        const ownUrl = !!p.baseUrl || (!!p.apiKey && p.provider !== "azure")
         config.providers.push({
             name: displayName(p),
             provider: p.provider,
             models: p.models,
             ...(env.key && p.apiKey ? { apiKeyEnv: env.key } : {}),
-            ...(env.url && p.baseUrl ? { baseUrlEnv: env.url } : {}),
+            ...(env.url && ownUrl ? { baseUrlEnv: env.url } : {}),
             ...(p.isDefault ? { default: true } : {}),
         })
     }