Replace the allowlist of private AI endpoint hosts (admin only)

Providers on private or loopback addresses, such as a self-hosted Ollama, are refused unless their host appears here. Without this an ordinary user could point a provider at an internal service and use the server as a probe of its own network.