agent window: a site's relay stands in for the endpoint it relays

On isokit.buildfor.life, entering https://inference.p0.contact/v1 in the
agent window's settings made the page call the inference server directly,
which browsers refuse (its nginx answers the CORS preflight with 401):
"The browser could not reach ... (Failed to fetch)".

- the relay meta names its upstream (data-upstream; build_web.py
  --agent-upstream, the deploy passes the inference server): that URL now
  goes through the relay and is saved as "follow the site's default"
- an unreachable endpoint says what to do: the relay's URL on a site with
  one, else isokit studio or isokit.buildfor.life
- check_web.py: relayed upstream and the unreachable message

tools/check_web.py

@@ -196,6 +196,34 @@ try:
         stored = pg.evaluate("() => JSON.parse(localStorage.getItem('isokit-agent'))")
         check(stored.get("key") == "test-key" and not stored.get("model"), f"settings stay in this browser {stored}")
 
+        # a site relay (here: the mock) stands in for its upstream, which pages may not call directly
+        upstream = "https://inference.p0.contact/v1"
+        pg.evaluate("""([u, up]) => { const m = document.createElement('meta'); m.name = 'isokit-agent'; m.content = u;
+            m.setAttribute('data-upstream', up); document.head.appendChild(m); }""", [agent_checks.MOCK + "/v1", upstream])
+        pg.locator("#agent").click()
+        pg.locator("#agset").click()
+        pg.locator("#agurl").fill(upstream + "/")
+        n_chat = len(agent_checks.chats())
+        pg.locator('#agsetf button[type="submit"]').click()
+        pg.wait_for_function("() => document.querySelector('#agwho .ag-on')", timeout=5000)
+        check(pg.evaluate("() => JSON.parse(localStorage.getItem('isokit-agent')).url") is None,
+              "entering the relayed endpoint keeps following the site's default")
+        pg.locator("#agtext").fill("hello via the relay")
+        pg.locator("#agtext").press("Enter")
+        pg.wait_for_function("() => !document.querySelector('.ag-busy')", timeout=10000)
+        check(len(agent_checks.chats()) == n_chat + 1, "the relayed endpoint is called through the relay")
+        # no relay for another site: the message says what to do
+        pg.evaluate("() => document.querySelector('meta[name=isokit-agent]').remove()")
+        pg.locator("#agset").click() if pg.locator("#agsetf").is_hidden() else None
+        pg.locator("#agurl").fill("http://127.0.0.1:7939/v1")
+        pg.locator('#agsetf button[type="submit"]').click()
+        pg.wait_for_function("() => /could not reach/.test(document.getElementById('agsetmsg').textContent)", timeout=15000)
+        msg = pg.locator("#agsetmsg").inner_text()
+        check("CORS" in msg and "isokit studio" in msg, "an unreachable endpoint on another site explains CORS and the way out: " + msg[:90])
+        shot(pg, "web-agent-unreachable.jpg")
+        pg.evaluate("() => localStorage.setItem('isokit-agent', JSON.stringify({url: arguments[0], key: 'test-key'}))".replace("arguments[0]", "'" + agent_checks.MOCK + "/v1'"))
+        pg.locator("#agclose").click()
+
         # ---------------------------------------------------------------- two tabs on one project
         pg2 = ctx.new_page()
         watch(pg2)
@@ -320,7 +348,7 @@ try:
         shot(pg, "web-narrow.jpg")
 
         # the browser logs the 401 of the agent window's wrong-key check
-        errs = [e for e in errs if "status of 401" not in e]
+        errs = [e for e in errs if "status of 401" not in e and "ERR_CONNECTION_REFUSED" not in e]
         check(not errs, f"no page errors {errs[:5]}")
         b.close()
 finally: