feat(providers): complete Jina + Gemini Embedding 2 multimodal via OmniRoute (#10581)

* feat(providers): complete Jina AI via OmniRoute including Omni multimodal

Dashboard and env keys share one Jina credential pool, native v5 Omni
{text}/{image}/{content} docs pass through /v1/embeddings intact, and
classify/segment/search are proxied without a third unused Jina card.

* chore(changelog): name Jina complete-provider fragment for #10581

* feat(providers): make Gemini Embedding 2 multimodal work via OmniRoute

Route gemini-embedding-2 through embedContent/batchEmbedContents so N
OpenAI input items become N vectors, pass through native multimodal
parts, and use dashboard Gemini keys (GEMINI_API_KEY only as fallback).

* fix(providers): resolve rebase fallout for Jina/Gemini embeddings

- narrow the two new no-explicit-any violations introduced by this PR
  (validateJinaFoundationProvider's params + catch, search.ts's
  normalizeJinaSearchResponse data param)
- cast credentials to Record<string, unknown> at the two quota-preflight
  call sites in src/sse/services/auth.ts so the new JinaEnvCredentials /
  GeminiEnvCredentials union members type-check without loosening the
  allRateLimited narrowing used elsewhere in the same function

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

---------

Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

.env.example

@@ -1275,6 +1275,14 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # hatches that are referenced in code today.
 # DEEPSEEK_API_KEY=
 # NVIDIA_API_KEY=
+# Jina Foundation API + Reader fallback when no dashboard jina-ai / jina-reader
+# connection exists. Dashboard keys always win (fill-first).
+# JINA_AI_API_KEY=
+# JINA_API_KEY=
+# Gemini / Google AI Studio embeddings fallback when no dashboard gemini
+# connection exists. Dashboard keys always win (fill-first).
+# GEMINI_API_KEY=
+# GOOGLE_API_KEY=
 
 # Windsurf / Devin CLI direct API key.
 # Used by: open-sse/executors/devin-cli.ts — bypasses OAuth when set.