fix(api): require access codes and limit sizes on helper routes

- Shared checkAccessCode for validate-diagram, validate-model, parse-url, verify-access-code
- parse-url: 5 MB streamed body limit; validate-diagram: 5 MB image limit
- validate-model refuses redirects when private URLs are blocked
- Admin settings state shared across module instances via globalThis
- Server model ids: unique slugs (non-ASCII names encoded), duplicates rejected
- Panel Bedrock credentials stored as ADMIN_AWS_* so the DynamoDB client keeps its own
- Locale redirect keeps basePath and query; EdgeOne function drops open CORS and checks the access code
- Providers payload reports whether .env sets a default model

tests/unit/edgeone-function.test.ts

@@ -0,0 +1,47 @@
+// @vitest-environment node
+import { describe, expect, it } from "vitest"
+import { onRequest } from "@/edge-functions/api/edgeai/chat/completions"
+
+function request(headers: Record<string, string>): Request {
+    return new Request("http://localhost/api/edgeai/chat/completions", {
+        method: "POST",
+        headers,
+        // Non-streaming requests return a mock reply without calling AI
+        body: JSON.stringify({ messages: [{ role: "user", content: "hi" }] }),
+    })
+}
+
+const json = { "Content-Type": "application/json" }
+
+describe("EdgeOne chat completions function", () => {
+    it("sends no CORS headers", async () => {
+        const res = await onRequest({ request: request(json), env: {} })
+        expect(res.status).toBe(200)
+        expect(res.headers.get("access-control-allow-origin")).toBeNull()
+    })
+
+    it("rejects non-JSON requests", async () => {
+        const res = await onRequest({
+            request: request({ "Content-Type": "text/plain" }),
+            env: {},
+        })
+        expect(res.status).toBe(400)
+    })
+
+    it("checks the access code when ACCESS_CODE_LIST is set", async () => {
+        const env = { ACCESS_CODE_LIST: "secret" }
+        const missing = await onRequest({ request: request(json), env })
+        expect(missing.status).toBe(401)
+
+        const ok = await onRequest({
+            request: request({ ...json, "x-access-code": "secret" }),
+            env,
+        })
+        expect(ok.status).toBe(200)
+    })
+
+    it("lets requests through when env is unavailable", async () => {
+        const res = await onRequest({ request: request(json) })
+        expect(res.status).toBe(200)
+    })
+})