refactor(agent): isolate Google tool credentials

[iamjr15]

Summary

• removes unsupported Gemini chat-model routing and the unused @ai-sdk/google dependency
• keeps Google AI as a tool credential for image generation, Veo video, and browser automation
• resolves the Google key lazily only when a Google-backed tool actually runs
• labels the setting as Google AI and explains every provider key through an accessible info tooltip

Architecture

Agent model selection now accepts only Anthropic, OpenAI, DeepSeek, and OpenRouter routes. The AgentRun stores a request-scoped Google-key resolver; media and browser tool boundaries invoke it on demand, and its promise is cached only for that active run.

Decisions Made

Decision	Choice	Reasoning
Google model support	Remove the hidden chat route	Gemini is not in the supported agent catalog and the setting exists for tools
Credential resolution	Lazy request-scoped resolver	Avoids decrypting or passing a Google key during runs that never use Google-backed tools
Settings copy	Info icon and tooltip	Keeps the list compact while making each key's purpose accessible on hover and focus

Edge Cases Handled

Scenario	Handling
Media tool runs without a Google key	Returns the existing actionable BYOK error using the Google AI label
Browser runs on DeepSeek/OpenRouter	Prefers configured Anthropic/OpenAI credentials, then lazily resolves Google AI
Repeated Google tool calls in one run	Shares one in-flight key-resolution promise without module-scope caching
Client submits google/<model>	Rejected by the shared logical model schema

Test Plan

• pnpm turbo typecheck lint build (55/55 tasks successful)
• staged Biome validation and commitlint hooks
• verify the Google AI row and provider tooltips on production after deployment
• verify the production Worker release after the Cloudflare workflow