fix: address codebase sweep findings for auth, keys, and usage logging

Move Gemini/Vertex validation to x-goog-api-key headers, require spawn auth on suggested-models, add usage-persist-failed observability, and document the MITM upstream TLS opt-out.

Co-authored-by: Cursor <cursoragent@cursor.com>