Add Gemini 3.7 Flash premium model support

[witbrock]

Summary

• add Google Gemini as a first-class premium provider in Settings and browser chat, with key verification, model discovery, exact actor-scoped eligibility, and reasoning controls
• route gemini-3.7-flash through the stateless Gemini Interactions API with response storage disabled, exact structured-tool continuation replay, provider-observed identity/usage telemetry, and no silent cross-provider substitution
• preserve legacy Gemini GenerateContent tool-call compatibility when the SDK omits optional call IDs
• add managed-host key-file and OpenStack configuration plumbing, plus a dormant governed Vontology release bundle with fail-closed publication/read-back
• gate Gemini embeddings before provider transport so actorless background indexing cannot transmit content or incur paid usage

Validation

• 276 focused backend/infra tests passed before final blocker repairs
• 195 post-fix backend/infra release tests passed
• 83 post-compatibility Gemini/orchestrator tests passed
• 419 frontend tests passed; frontend static lint passed
• exact locked google-genai==2.6.0 optional call-ID contract and transport suite verified
• Ruff fatal-error checks, pdm lock --check, and git diff --check passed
• signed-in Settings replay showed Google Gemini selected, gemini-3.7-flash listed and persisted as allowed, and the exact live-test control enabled
• live provider call returned the requested sentinel from gemini-3.7-flash via Interactions with store=false and provider-reported usage
• .env remains ignored; the 52-file commit contains no key-shaped secret or Sol-model reference

Release boundary

The represented model-registry bundle remains dormant until an authenticated global semantic authority publishes it and canonical read-back succeeds. That does not block Settings or Gemini API execution. Local server deployment/restart will follow merge and successful required CI.