fix(server): use the keys the user sent, and more review fixes

Found by the second PR review:
- With AWS_BEARER_TOKEN_BEDROCK set on the server, a request with the
  user's AWS keys ran on the server's token: the Bedrock SDK prefers it.
  Checked with Bedrock: invalid user keys used to get an answer.
- An OpenAI key with the official URL filled in (the settings form does
  that) went to the Responses API. Back to main's rule: a configured base
  URL uses Chat Completions.
- A user's Ollama key went to the server's OLLAMA_BASE_URL, for chat and
  for the model list. Like every other provider, it goes to the user's
  base URL or Ollama Cloud.
- The server's keyless Ollama and EdgeOne were not counted in the quota.
- AI_MODEL models on the server's keys ran on any provider with a server
  key, not only on AI_PROVIDER.
- A user's Azure key without a base URL used the server's resource name.
- The admin panel's Test button failed whenever access codes were set.
- DeepSeek's errors in the stream (plain text) were shown as they were,
  without a hint and also on the server's keys. Bedrock's throttling in
  the stream was not recognised as a rate limit.
- The EdgeOne function accepted text/plain; x=application/json, which
  other sites can send without a CORS preflight.
- Desktop app: a launch that found the old port taken for a moment (the
  previous version still quitting after an update) remembered the new
  port for good. The new port is kept only when Windows reserves the old
  one. A failed read of the presets file moved it aside as corrupt, and a
  save could then replace the presets. Switching presets on the same port
  now reloads the page. The dev launcher no longer misses a preset change
  made before or during a restart.

app/api/validate-model/route.ts

@@ -2,6 +2,7 @@ import { streamText, tool } from "ai"
 import { NextResponse } from "next/server"
 import { z } from "zod"
 import { checkAccessCode } from "@/lib/access-code"
+import { checkAdminAuth } from "@/lib/admin/auth"
 import { getAIModel, usesServerCredentials } from "@/lib/ai-providers"
 import { classifyLLMError } from "@/lib/llm-errors"
 import { allowPrivateUrls, isPrivateUrl } from "@/lib/ssrf-protection"
@@ -34,9 +35,10 @@ const NO_TOOL_CALL_WARNING =
     "Connected, but the model answered without calling a tool. It may not support tool calls, which drawing needs."
 
 export async function POST(req: Request) {
-    // Lets the server send requests to arbitrary URLs, so require the access code
+    // Lets the server send requests to arbitrary URLs, so require the access
+    // code, or the admin password (the admin panel's Test button)
     const accessError = checkAccessCode(req)
-    if (accessError) return accessError
+    if (accessError && checkAdminAuth(req)) return accessError
 
     try {
         const body: ValidateRequest = await req.json()