resp.json() raises UnicodeDecodeError (not JSONDecodeError) when the remote body contains invalid UTF-8 bytes, which the exception handler did not catch and could crash the app. Apply the same fix to both _load_model_catalog and fetch_ollama_models so they fall back to an empty catalog. Add regression tests for both paths.