fix: re-throw ApiError in SSRF catch block so private-IP guards actually work

The bare catch {} swallowed the ApiError thrown by the private-IP
checks, defeating the entire DNS-based SSRF protection. Now catches
and re-throws ApiError so security rejections propagate correctly;
only DNS-lookup failures fall through.

packages/dashboard/src/routes/register-custom-provider-routes.ts

@@ -211,7 +211,8 @@ async function probeProviderModels(
         if (parts[0] === 169 && parts[1] === 254) throw badRequest("baseUrl must not be a loopback or private address");
       }
     }
-  } catch {
+  } catch (err) {
+    if (err instanceof ApiError) throw err;
     // DNS resolution failed — proceed without SSRF check; the fetch will fail naturally
   }