feat(providers): add Google Cloud Vertex AI provider (#5)

* feat(providers): add Google Cloud Vertex AI provider (#576)

Add `vertex` built-in provider type that routes Gemini calls through Google
Cloud Vertex AI's OpenAI-compatible endpoint. Enterprises on GCP can now use
regional endpoints for data residency, consolidate AI spend under existing GCP
billing, enforce IAM/VPC-SC controls, and use committed-use discounts instead
of standalone Google AI Studio API keys.

Implementation reuses OpenAIProvider via the OpenAI-compat path; the only
provider-specific logic is OAuth2 auth wiring:

- New factory NewVertexProvider in internal/providers/vertex.go builds an
  *http.Client with oauth2.Transport, which auto-refreshes GCP access tokens
  (1-hour lifetime) transparently. Credentials precedence:
  inline SA JSON > credentials_file path > Application Default Credentials
  (works on GKE/Cloud Run/Compute Engine via metadata server).
- OpenAIProvider gets WithHTTPClient() + WithoutAuthHeader() options so the
  oauth2 transport injects Authorization rather than doRequest() setting a
  static Bearer header.
- Endpoint URL computed at registration time from project_id + region:
  https://{region}-aiplatform.googleapis.com/v1/projects/{p}/locations/{r}/endpoints/openapi
- Store: api_key column holds AES-256-GCM-encrypted SA JSON (same as other
  providers); settings JSONB holds {project_id, region, model}.
- Env vars: GOCLAW_VERTEX_{API_KEY,CREDENTIALS_FILE,PROJECT_ID,REGION,MODEL}.

Registration wired through all three paths: config-driven startup, DB-driven
startup, and HTTP CRUD in-memory registration. Vertex handled before the
generic "api_key empty" guard so ADC deployments register correctly.

Code-review fixes applied:

- H1 (correctness): Gemini thought_signature detection in openai.go now
  recognizes providerType="vertex" and apiBase suffix "aiplatform". Previously
  only worked because the default model string coincidentally contained
  "gemini"; custom model IDs or fine-tuned endpoint numeric IDs would drop the
  signature on passback and trigger HTTP 400 mid-tool-loop. Regression test
  added (TestVertexProviderForwardsThoughtSignatureOnToolCalls).
- M1 (hardening): region and project_id are regex-validated before URL
  concatenation to prevent hostname injection (e.g. region="evil.com/a?").
- M2 (hardening): APIBaseOverride must be https + *.googleapis.com host to
  prevent data exfiltration via crafted DB rows.
- M3 (documentation): CredentialsFile marked operator-only in the struct
  comment — never expose via admin UI or DB settings without path allow-list.

Tests: 17 Vertex-related unit tests. go build ./... + go build -tags sqliteonly
./... + go vet ./... all clean. Pre-existing TestSignMediaPath failure on
Windows (file_token.go uses path/filepath) is unrelated to this change.

* chore: trigger CI on digitopvn/goclaw fork

* ci: ping

* ci: retrigger workflows

cmd/gateway_providers.go

@@ -174,6 +174,27 @@ func registerProviders(registry *providers.Registry, cfg *config.Config, modelRe
 		slog.Info("registered provider", "name", "byteplus-coding")
 	}
 
+	// Google Cloud Vertex AI — OAuth2 service account or Application Default Credentials.
+	// Registers when project_id + region are set. Credential sources (priority order):
+	// inline JSON (APIKey) → file path (CredentialsFile) → ADC.
+	if cfg.Providers.Vertex.ProjectID != "" && cfg.Providers.Vertex.Region != "" {
+		vcfg := providers.VertexConfig{
+			Name:            "vertex",
+			CredentialsJSON: cfg.Providers.Vertex.APIKey,
+			CredentialsFile: cfg.Providers.Vertex.CredentialsFile,
+			ProjectID:       cfg.Providers.Vertex.ProjectID,
+			Region:          cfg.Providers.Vertex.Region,
+			DefaultModel:    cfg.Providers.Vertex.Model,
+		}
+		prov, err := providers.NewVertexProviderWithTimeout(vcfg)
+		if err != nil {
+			slog.Warn("vertex: initialization failed", "error", err)
+		} else {
+			registry.Register(prov)
+			slog.Info("registered provider", "name", "vertex", "region", cfg.Providers.Vertex.Region, "project", cfg.Providers.Vertex.ProjectID)
+		}
+	}
+
 	// Claude CLI provider (subscription-based, no API key needed)
 	if cfg.Providers.ClaudeCLI.CLIPath != "" {
 		cliPath := cfg.Providers.ClaudeCLI.CLIPath
@@ -323,6 +344,30 @@ func registerProvidersFromDB(registry *providers.Registry, provStore store.Provi
 			slog.Info("registered provider from DB", "name", p.Name)
 			continue
 		}
+		// Vertex supports ADC (empty api_key) — handle before the generic key guard.
+		if p.ProviderType == store.ProviderVertex {
+			vsettings := store.ParseVertexProviderSettings(p.Settings)
+			if vsettings == nil {
+				slog.Warn("vertex: missing project_id/region in settings, skipping", "name", p.Name)
+				continue
+			}
+			vcfg := providers.VertexConfig{
+				Name:            p.Name,
+				CredentialsJSON: p.APIKey,
+				ProjectID:       vsettings.ProjectID,
+				Region:          vsettings.Region,
+				DefaultModel:    vsettings.Model,
+				APIBaseOverride: p.APIBase,
+			}
+			prov, err := providers.NewVertexProviderWithTimeout(vcfg)
+			if err != nil {
+				slog.Warn("vertex: init from DB failed", "name", p.Name, "error", err)
+				continue
+			}
+			registry.RegisterForTenant(p.TenantID, prov)
+			slog.Info("registered provider from DB", "name", p.Name, "type", "vertex", "region", vsettings.Region)
+			continue
+		}
 
 		if p.APIKey == "" {
 			continue