An empty host gives a CSP connect-src that blocks every API call. The new entrypoint check stops the container early with a clear error.
