fix(teams): preserve Gemini model provider provenance

[FerroxLabs]

A rejected Gemini Team default could be rebound to Google OAuth with the rejected model ID. For example, disabled moonshot/kimi-k2.7-code resolved as google-auth-gemini + kimi-k2.7-code whenever OAuth credentials existed.

This change retains supported explicit Google OAuth selections, keeps valid enabled API selections on their owning provider, and routes rejected object/string defaults to the existing shared Gemini auto mode without carrying the rejected provider key or base URL. A three-member fixture covers conversation persistence and worker construction.

Validation:

• ASTRA bounded adversarial audit
• typecheck, focused provider/team/lifecycle tests, and prek
• Linux pairing fixture
• full Linux aggregate: 21,519 Vitest passed / 53 skipped and 285 Bun tests passed

Live Google OAuth provider acceptance was unavailable on the verification machine and remains unverified. No release or issue closure is included.

Refs #983