fix(ai): turn a bare 'Failed to fetch' into an actionable BYOK error

chatPublic() calls the provider's /chat/completions directly from the
renderer. Verified live: a saved profile pointing at
platform.deepseek.com (DeepSeek's console) instead of api.deepseek.com
(their actual API) fails the CORS preflight outright - 403, no
Access-Control-* headers - which surfaces to fetch() as an
undifferentiated "Failed to fetch" with no status to inspect. Confirmed
the real API and OpenRouter both support being called directly from a
browser fine, so the architecture is sound; only the error message was
useless. Now names the URL and the likely cause instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

lib/ai/local-client.ts

@@ -135,14 +135,33 @@ export async function chatPublic(
   model: string,
   messages: ChatMessage[],
 ): Promise<string> {
-  const res = await fetch(`${baseUrl.replace(/\/+$/, '')}/chat/completions`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      Authorization: `Bearer ${apiKey}`,
-    },
-    body: JSON.stringify({ model, messages }),
-  });
+  const url = `${baseUrl.replace(/\/+$/, '')}/chat/completions`;
+  let res: Response;
+  try {
+    res = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${apiKey}`,
+      },
+      body: JSON.stringify({ model, messages }),
+    });
+  } catch {
+    // A request that never got a response (DNS failure, TLS failure, or -
+    // by far the most common cause in practice - a CORS preflight the
+    // target rejected) surfaces to fetch() as a bare, undifferentiated
+    // "TypeError: Failed to fetch" with no status code to inspect. Verified
+    // live: a Base URL pointing at a provider's website instead of its API
+    // (platform.deepseek.com vs api.deepseek.com) fails exactly this way,
+    // the preflight OPTIONS getting a 403 with no Access-Control-* headers
+    // at all. Naming the Base URL is the one actionable thing this error
+    // can tell the user, since the browser gives back nothing else.
+    throw new Error(
+      `Could not reach ${url} — check the Base URL is the provider's API endpoint, not its ` +
+        'website or console (e.g. api.deepseek.com, not platform.deepseek.com), and that it ' +
+        'allows being called directly from a browser.',
+    );
+  }
   if (!res.ok) throw new Error(`Provider returned ${res.status}`);
   const body = (await res.json()) as OpenAiChatResponse;
   const content = body.choices?.[0]?.message?.content;