fix(admin): address Copilot review findings

- Reflect built-in defaults for boolean settings (ALLOW_PRIVATE_URLS
  defaults on) and allow clearing a saved boolean back to default,
  so the SSRF toggle matches actual runtime behavior.
- Harden JSON loading: filter settings values to strings only, and
  schema-validate stored ADMIN_PROVIDERS entries, dropping malformed
  ones instead of letting them reach runtime code.
- Set beforeunload returnValue so the unsaved-changes prompt shows in
  all browsers; reject non-finite numbers in settings validation.
- Fix README/CN/JA docs that claimed the panel auto-generates
  AI_MODELS_CONFIG (providers are merged at read time, not written).
- Add unit tests for corrupted-file value filtering and provider
  schema validation.

app/api/admin/settings/route.ts

@@ -42,7 +42,7 @@ function validateValue(def: SettingDef, value: string): string | null {
     switch (def.type) {
         case "number": {
             const num = Number(value)
-            if (Number.isNaN(num)) return "Must be a number"
+            if (!Number.isFinite(num)) return "Must be a number"
             if (def.min !== undefined && num < def.min)
                 return `Must be at least ${def.min}`
             if (def.max !== undefined && num > def.max)