fix(api): require access codes and limit sizes on helper routes

- Shared checkAccessCode for validate-diagram, validate-model, parse-url, verify-access-code
- parse-url: 5 MB streamed body limit; validate-diagram: 5 MB image limit
- validate-model refuses redirects when private URLs are blocked
- Admin settings state shared across module instances via globalThis
- Server model ids: unique slugs (non-ASCII names encoded), duplicates rejected
- Panel Bedrock credentials stored as ADMIN_AWS_* so the DynamoDB client keeps its own
- Locale redirect keeps basePath and query; EdgeOne function drops open CORS and checks the access code
- Providers payload reports whether .env sets a default model

app/api/admin/providers/route.ts

@@ -7,7 +7,11 @@ import {
     mergeSecrets,
     validateAdminProviders,
 } from "@/lib/admin/providers"
-import { isSettingsWritable, saveSettings } from "@/lib/admin/settings"
+import {
+    getEnvFallback,
+    isSettingsWritable,
+    saveSettings,
+} from "@/lib/admin/settings"
 import { loadEnvServerModelsConfig } from "@/lib/server-model-config"
 
 export const runtime = "nodejs"
@@ -33,6 +37,9 @@ async function payload() {
                 models: p.models,
                 isDefault: !!p.default && !adminHasDefault,
             })) ?? [],
+        // Whether .env sets a default model. getEnvFallback skips the value
+        // the panel overlays onto process.env, so a panel default doesn't count.
+        envHasDefaultModel: !!getEnvFallback("AI_MODEL"),
     }
 }