fix(vertex): discover and route partner models correctly

[JxnLexn]

Summary

• support both Vertex API keys and Service Account JSON credentials without mixing their capabilities
• infer and persist the Google Cloud consumer project for project-scoped API-key partner inference
• use API-key model discovery only for Gemini and fall back intentionally to a curated project-scoped catalog because Google rejects API keys for publishers.models.list
• fetch the live Model Garden catalog for Google, xAI, Anthropic, Mistral, and open-MaaS publishers with OAuth or Service Account credentials using Google's maximum page size of 300
• treat the authenticated Google publisher catalog as the live source for current Gemini chat models, including Gemini 3.5, 3.6, 3.7, and 3.8 Flash
• retain successful publisher results when the separate Gemini Developer API rejects Service Accounts
• accept requestAccess-backed MaaS model cards while excluding image, TTS, live, transcription, embedding, OCR-only, and retired Gemini entries from the chat catalog
• replace invalid speculative Vertex IDs with documented MaaS IDs such as deepseek-ai/deepseek-v3.2-maas, qwen/qwen3-next-80b-a3b-instruct-maas, and zai-org/glm-5-maas
• route Gemini, Anthropic, Mistral, xAI, and generic OpenAI-compatible MaaS publishers through their correct transports
• label the dashboard credential field accurately and explain that Service Account JSON enables live Model Garden discovery
• reject OAuth client configuration JSON with a specific explanation instead of reporting missing Service Account fields

Authentication behavior

A project-bound API key can execute partner models, but Google does not allow it to call Model Garden publishers.models.list. OmniRoute extracts the bound project from structured Google error metadata and uses the curated project-scoped catalog.

A Service Account JSON credential is exchanged for an OAuth access token. That bearer token can list publishers/google/models and the partner publisher catalogs, so successful discovery now returns catalogMode=live_vertex_catalog without supplementing the result with a stale static Gemini baseline.

Google separately rejects Service Accounts on generativelanguage.googleapis.com. That expected rejection no longer marks the entire Vertex discovery as failed.

An OAuth web-client JSON file is only client configuration and is not itself an access credential. It requires a complete authorization-code and refresh-token flow and is now rejected with a clear message.

Reproduction covered

The live Publisher Model list request used pageSize=1000 although Google enforces a maximum of 300. Every publisher returned HTTP 400, leaving an empty discovery result and causing Sync Models to report:

Vertex model catalogs unavailable — using local catalog

The corrected request returns the live Google and partner catalogs. Gemini chat filtering is capability-oriented: current Flash/Flash Lite/Pro variants from Gemini 2.5 onward are imported, while non-chat and retired entries are excluded.

Verification

• focused Vertex Node tests on the release branch: 24 passed
• focused provider-dialog tests from the credential UI change: 20 passed
• npm run typecheck:core
• live Service Account token exchange: HTTP 200
• deployed fork image revision fed218e
• deployed live discovery: source=api, catalogMode=live_vertex_catalog, 29 synchronized models, no warning
• deployed live catalog includes gemini-3.5-flash, gemini-3.6-flash, gemini-3.7-flash, gemini-3.8-flash, claude-opus-4-1, and mistral-medium-3
• deployed catalog excludes image, TTS, retired Gemini 1.5, and the former speculative partner IDs
• deployed vertex/gemini-3.7-flash model test: HTTP 200