Fix private AI custom endpoints

[ZacharyZcR]

Summary

• route explicitly allowlisted private DNS endpoints through the private provider fetch path
• make hostname entries such as host.docker.internal and llm.internal actually effective
• show actionable model refresh errors instead of silently leaving the model list empty
• preserve the backend warning when probing an unsaved OpenAI-compatible provider

Verification

• npm test -- --run src/backend/tests/ai/egress.test.ts src/backend/tests/ai/providers.test.ts src/ui/tests/features/ai/AiProviderSettings.test.tsx
• npm run type-check
• npm run build
• targeted ESLint and Prettier checks

Fixes Termix-SSH/Support#1199