feat(vertex): add ADC-only native Vertex provider support

[wavewiser]

Summary

• add native vertex provider with Google ADC-backed token source and streaming/tool-call support
• expose Vertex in provider setup flows and enforce ADC-only policy (reject api_key for vertex)
• add Docker compose overlay for Vertex ADC mount (docker-compose.vertex.yml)

Test plan

• go test ./internal/providers ./internal/http ./cmd ./internal/store ./internal/config
• verify setup/provider UI flow for Google Vertex AI no longer requires API key
• WITH_VERTEX=1 make -n up