fix: what the third round broke, and the first batch's review

MCP preview after the server lost a session (it expired, or the MCP
process restarted):
- Every server state has an id, made when the state is created. The tab
  notices a new id even when the version numbers happen to match, and
  every push names the state it was based on, so one based on a lost state
  is refused, also when it comes before the tab's first poll (the server
  recovers the saved file first).
- The tab keeps the newest canvas XML, saved or not. When the server knows
  nothing (no file) or exactly what the tab last saved, the canvas wins and
  is saved, so edits made while the server was down are kept. Otherwise
  the server's diagram (an AI write the tab missed, a cleared document
  that was saved) is shown and the tab's copy goes to History.
- Late answers to an old state's push or poll are dropped; a failed push
  says the server is unreachable; Download as .drawio saves the canvas.

Settings and server:
- Saved providers this version does not know stay in storage with their
  keys, and sending no longer trips over them.
- The desktop "Ollama (Local)" preset with a key goes to local Ollama
  again; a server model's Ollama URL variable is read; the admin panel
  writes Ollama Cloud's URL for a key without one.
- Provider error texts show again in the desktop app and for EdgeOne.
- .env: a quoted value followed by a comment ending in a quote is read as
  dotenv reads it; unquoted values are unchanged.
- Desktop app: the next launch opens the port where a chat was last
  saved; a launch elsewhere that saves nothing does not move it, and a
  page with no chats lets the next launch try the other port once.
- The Test button no longer stays busy after another tab changed the key.
- A completed append_diagram is no longer undone by an earlier failed
  edit's preview; a file read once in vain is saved again once it is read
  or gone.

From the first batch's review:
- The admin panel's Test of an entry without a URL now tests the server's
  <P>_BASE_URL, where chat sends the entry's key; chat is unchanged (the
  first fix rerouted working setups).
- The model list ends downloads that are too large, accepts answers
  without a body, and keeps the "redirects are not allowed" explanation.
- A test covers the preview's History rendering.

tests/unit/ai-providers-credentials.test.ts

@@ -378,25 +378,6 @@ describe("whose keys a request uses", () => {
         expect(provider.chat).not.toHaveBeenCalled()
     })
 
-    it("sends an admin OpenAI key without a URL to the official endpoint", () => {
-        // Its URL variable is named but empty; the SDK would otherwise read
-        // the server's OPENAI_BASE_URL, a proxy for another key
-        process.env.OPENAI_BASE_URL = "https://operator-proxy.example.com/v1"
-        process.env.ADMIN_OPENAI_API_KEY = "panel-key"
-        getAIModel({
-            provider: "openai",
-            modelId: "gpt-5.5",
-            apiKeyEnv: "ADMIN_OPENAI_API_KEY",
-            baseUrlEnv: "ADMIN_OPENAI_BASE_URL",
-        })
-        expect(createOpenAI).toHaveBeenLastCalledWith(
-            expect.objectContaining({
-                apiKey: "panel-key",
-                baseURL: "https://api.openai.com/v1",
-            }),
-        )
-    })
-
     it("uses Chat Completions for any configured base URL", () => {
         // The settings form fills in the official URL for a new provider
         getAIModel({
@@ -425,21 +406,44 @@ describe("whose keys a request uses", () => {
         )
     })
 
-    it("sends the server's Ollama key without a base URL to Ollama Cloud", async () => {
-        // An Ollama key is an Ollama Cloud key: local Ollama has none.
-        // The admin panel saves it as OLLAMA_API_KEY, without a base URL.
+    it("sends the server's Ollama key where OLLAMA_BASE_URL says, or to local Ollama", async () => {
+        // The desktop app's "Ollama (Local)" preset puts its API Key field
+        // into OLLAMA_API_KEY; with no base URL that is the local Ollama
         process.env.OLLAMA_API_KEY = "server-key"
         const { createOllama } = await import("ollama-ai-provider-v2")
         getAIModel({ provider: "ollama", modelId: "m" })
-        expect(createOllama).toHaveBeenLastCalledWith(
-            expect.objectContaining({ baseURL: "https://ollama.com/api" }),
-        )
-        // Without a key: the SDK's local default
-        delete process.env.OLLAMA_API_KEY
-        getAIModel({ provider: "ollama", modelId: "m" })
         expect(vi.mocked(createOllama).mock.lastCall?.[0]).not.toHaveProperty(
             "baseURL",
         )
+        process.env.OLLAMA_BASE_URL = "https://ollama.com/api"
+        getAIModel({ provider: "ollama", modelId: "m" })
+        expect(createOllama).toHaveBeenLastCalledWith(
+            expect.objectContaining({ baseURL: "https://ollama.com/api" }),
+        )
+    })
+
+    it("uses a server model's own Ollama URL variable", async () => {
+        process.env.OLLAMA_BASE_URL = "http://other.internal:11434/api"
+        process.env.MY_OLLAMA_URL = "https://ollama.proxy.example/api"
+        process.env.MY_OLLAMA_KEY = "proxy-key"
+        try {
+            const { createOllama } = await import("ollama-ai-provider-v2")
+            getAIModel({
+                provider: "ollama",
+                modelId: "m",
+                apiKeyEnv: "MY_OLLAMA_KEY",
+                baseUrlEnv: "MY_OLLAMA_URL",
+            })
+            expect(createOllama).toHaveBeenLastCalledWith(
+                expect.objectContaining({
+                    baseURL: "https://ollama.proxy.example/api",
+                    headers: { Authorization: "Bearer proxy-key" },
+                }),
+            )
+        } finally {
+            delete process.env.MY_OLLAMA_URL
+            delete process.env.MY_OLLAMA_KEY
+        }
     })
 
     it("needs a base URL with a user's Azure key", () => {