feat(ai): add Gemini LLM provider

[ArionMiles]

Description

Adds Google Gemini as a first-class LLM provider for AI-assisted rule drafting. The change uses Gemini's Interactions API with structured outputs, moves provider presentation/configuration metadata into validated catalog JSON, and generalizes the AI settings experience for multiple providers.

It also adds a rule-editor privacy reminder, masks email addresses and card-like numbers before provider requests, and keeps Gemini's endpoint fixed so API keys and prompt data cannot be redirected through hidden configuration.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring
• Performance improvement
• Build/CI configuration change

Related Issue

None.

Changes Made

• Add a Gemini provider backed by the Interactions API, including JSON-schema outputs, health checks, thinking-level selection, usage parsing, and sanitized provider errors.
• Load provider display, API-key, data-use, model, and configuration metadata from strictly validated catalog JSON while keeping implementation capabilities in code.
• Generalize AI settings with URL-persisted provider tabs, provider-specific configuration, dashboard links, data-use notices, and icon-only actions with accessible tooltips.
• Add the rule-editor data-sharing reminder with per-user/provider dismissal and redact email addresses and card-like numbers before rule-draft requests.
• Add backend, frontend, component, and contract coverage for provider behavior, lifecycle, catalog validation, redaction, settings UX, and privacy persistence.

Testing

• Unit tests pass (task test:be)
• Linter passes (task lint:be:prod and task lint:fe)
• Manual testing completed
• Added new tests (if applicable)

Additional verification:

• task test:fe
• task test:be:component
• task test:be:contract
• task build
• OpenAPI regenerated deterministically
• Backend and frontend dependency audits passed
• Independent code review found no remaining Critical or Important findings

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• Any dependent changes have been merged and published

Screenshots (if applicable)

Not included. The provider settings and privacy-dialog behavior are covered by frontend tests and were manually exercised during implementation.

Additional Notes

pre-commit run --all-files passed formatting, linting, tests, and audits. Its unconditional Docker build encountered an existing Vite/Rolldown onLog incompatibility under the Docker Node 26 image. The normal staged-file pre-commit run skipped that unrelated hook because this change does not modify the Dockerfile or dependency manifests, and all selected hooks passed.