fix: harden model provider endpoints

[fly1d]

Summary

• replace regex/string URL assembly with structured URL parsing in the Web API and macOS provider
• restrict Web model requests to server-configured endpoints and expose the policy to the UI
• remove permissive CORS because Web development and production use same-origin requests
• fix the desktop OpenAI hostname boundary check
• add Web/API and Rust regression tests and execute Rust tests in the desktop gate
• disable unsupported CodeQL database uploads while retaining local SARIF enforcement

Verification

• npm run check (10 tests passed)
• npm run test:smoke (5 passed, 1 intentional desktop skip)
• npm run desktop:check (2 Rust tests passed)
• npm audit (0 vulnerabilities)
• workflow YAML and diff checks

Security impact

Fixes js/request-forgery and js/polynomial-redos found by the full main-branch CodeQL scan. Web custom endpoints must now be supplied via OLLAMA_BASE_URL or OPENAI_BASE_URL; the macOS app remains locally configurable.

[fly1d]

Security-aware code review completed. No blocking findings.

Reviewed the trusted endpoint boundary, structured URL assembly, same-origin Web policy, desktop hostname handling, CodeQL upload settings, dependency removal, UI policy propagation, and regression coverage. All PR checks are green, including CodeQL, browser smoke, 10 Web/API tests, and 2 Rust tests.