feat(providers): add Vercel AI Gateway (vercel-ai-gateway)

12th provider. API-key via AI_GATEWAY_API_KEY, Bearer, OpenAI listing +
ChatCompletions, Passthrough dialect. Second wire-metadata provider but
takes the enrichment path instead: Vercel serves context under
context_window, which WireModel ignores (reads context_length), so
wire_serves_metadata=false + restrict_to_enriched pulls context/limits
from the models.dev "vercel" snapshot (302/306 live ids match snapshot
keys byte-for-byte, so restrict keeps essentially the whole catalog).

/models is public (200 for any key), so login validation targets
/credits (key_validation_path) which 401s on a bad bearer — avoids
false-accepting invalid keys against the public listing.

Tests: e2e proves enrichment-wins (wire context_window=999 distinct from
enrichment context=400000, asserts 400000) and non-vacuous tool_call
restriction; validation test proves /credits (not /models) is hit.
Registry at 15 (ordinal/VARIANT_COUNT/ALL), 4 auth arrays + 16-row picker.

crates/codegen/kigi-shell/src/agent/auth_method.rs

@@ -606,7 +606,8 @@ mod tests {
                 "openrouter",
                 "together",
                 "cerebras",
-                "nvidia"
+                "nvidia",
+                "vercel-ai-gateway"
             ]
         );
         assert_eq!(default_id(&built), Some(XAI_API_KEY_METHOD_ID));
@@ -643,7 +644,8 @@ mod tests {
                 "openrouter",
                 "together",
                 "cerebras",
-                "nvidia"
+                "nvidia",
+                "vercel-ai-gateway"
             ]
         );
         assert_eq!(default_id(&built), Some(CACHED_TOKEN_AUTH_METHOD_ID));
@@ -673,7 +675,8 @@ mod tests {
                 "openrouter",
                 "together",
                 "cerebras",
-                "nvidia"
+                "nvidia",
+                "vercel-ai-gateway"
             ]
         );
         assert_eq!(default_id(&built), Some(CACHED_TOKEN_AUTH_METHOD_ID));
@@ -706,7 +709,8 @@ mod tests {
                 "openrouter",
                 "together",
                 "cerebras",
-                "nvidia"
+                "nvidia",
+                "vercel-ai-gateway"
             ]
         );
         assert_eq!(default_id(&built), None);
@@ -874,6 +878,38 @@ mod tests {
         );
     }
 
+    /// Vercel's `/models` is public too; validation must hit `/credits`
+    /// (401s for a bad key). A bad key is rejected even though `/models`
+    /// would 200.
+    #[tokio::test]
+    #[serial]
+    async fn vercel_validates_against_credits_endpoint_not_public_models() {
+        use wiremock::matchers::{method, path};
+        let server = wiremock::MockServer::start().await;
+        wiremock::Mock::given(method("GET"))
+            .and(path("/models"))
+            .respond_with(
+                wiremock::ResponseTemplate::new(200)
+                    .set_body_json(serde_json::json!({ "data": [] })),
+            )
+            .mount(&server)
+            .await;
+        wiremock::Mock::given(method("GET"))
+            .and(path("/credits"))
+            .respond_with(wiremock::ResponseTemplate::new(401))
+            .expect(1)
+            .mount(&server)
+            .await;
+        let _base = EnvGuard::set(kigi_models::VERCEL_BASE_URL_ENV, &server.uri());
+        let err = authenticate_platform_api_key(kigi_models::PlatformId::Vercel, Some("vg-bad"))
+            .await
+            .expect_err("a bad key must be rejected via /credits, not accepted via /models");
+        assert_eq!(
+            err.message,
+            "Invalid API key for vercel-ai-gateway \u{2014} check your key on vercel.com"
+        );
+    }
+
     /// A valid OpenRouter key: `/key` returns 200 → accepted.
     #[tokio::test]
     #[serial]