Refactor AI config to step-based wizard with DeepSeek defaults

apps/server/src/ai-chat/ai-model-stream.service.ts

@@ -26,6 +26,10 @@ interface StreamChoiceDelta {
 }
 
 const MAX_UPSTREAM_EVENT_BYTES = 1024 * 1024;
+
+// Known public provider hosts — trusted even if CDN resolves to private-range IPs
+const DNS_TRUSTED_HOSTS = new Set(['api.openai.com', 'api.deepseek.com']);
+
 const PRIVATE_IPV4_RANGES = [
   /^127\./,
   /^10\./,
@@ -180,7 +184,9 @@ export class AiModelStreamService {
       const port = parsed.port ? Number(parsed.port) : isHttps ? 443 : 80;
       lookup(parsed.hostname, { all: true, family: 0 }, (dnsError, addresses) => {
         if (dnsError || !addresses?.length) return reject(new Error('DNS 解析失败'));
-        const allowPrivate = process.env.AI_ALLOW_PRIVATE_BASE_URL === 'true';
+        const allowPrivate =
+          process.env.AI_ALLOW_PRIVATE_BASE_URL === 'true' ||
+          DNS_TRUSTED_HOSTS.has(parsed.hostname);
         if (!allowPrivate && addresses.some(({ address }) => this.isPrivateAddress(address))) {
           return reject(new Error('域名解析到内网地址'));
         }