feat: Google Gemini image generation for project covers

Schema:
- SystemSettings: geminiApiKey, geminiModel, imageProvider fields
- imageProvider: "dalle" (default) or "gemini"

Gemini Client (packages/api/src/gemini-client.ts):
- Direct HTTP call to Gemini REST API with responseModalities: [TEXT, IMAGE]
- Returns base64 data URL
- Error parsing with user-friendly messages

Router (project.ts):
- generateCover: routes to DALL-E or Gemini based on imageProvider setting
- New isImageGenConfigured query returning { configured, provider }

Admin UI (SystemSettingsClient.tsx):
- "Image Generation" section with provider radio buttons (DALL-E / Gemini)
- Conditional fields: DALL-E config or Gemini API key + model
- Separate save button for image settings

Security:
- geminiApiKey sanitized in audit logs (SENSITIVE_FIELDS)
- API key stored server-side only, never sent to client

Co-Authored-By: claude-flow <ruv@ruv.net>

packages/api/src/router/project.ts

@@ -12,6 +12,7 @@ import { buildDynamicFieldWhereClauses } from "./custom-field-filters.js";
 import { loadProjectPlanningReadModel } from "./project-planning-read-model.js";
 import { adminProcedure, controllerProcedure, createTRPCRouter, managerProcedure, protectedProcedure, requirePermission } from "../trpc.js";
 import { createDalleClient, isDalleConfigured, parseAiError } from "../ai-client.js";
+import { generateGeminiImage, isGeminiConfigured, parseGeminiError } from "../gemini-client.js";
 import { invalidateDashboardCache } from "../lib/cache.js";
 import { dispatchWebhooks } from "../lib/webhook-dispatcher.js";
 
@@ -434,10 +435,14 @@ export const projectRouter = createTRPCRouter({
         where: { id: "singleton" },
       });
 
-      if (!isDalleConfigured(settings)) {
+      const imageProvider = settings?.imageProvider ?? "dalle";
+      const useGemini = imageProvider === "gemini" && isGeminiConfigured(settings);
+      const useDalle = imageProvider === "dalle" && isDalleConfigured(settings);
+
+      if (!useGemini && !useDalle) {
         throw new TRPCError({
           code: "PRECONDITION_FAILED",
-          message: "DALL-E is not configured. Set up the DALL-E deployment in Admin → Settings.",
+          message: "No image provider configured. Set up DALL-E or Gemini in Admin → Settings.",
         });
       }
 
@@ -447,36 +452,53 @@ export const projectRouter = createTRPCRouter({
         ? `${basePrompt} Additional direction: ${input.prompt}`
         : basePrompt;
 
-      const dalleClient = createDalleClient(settings!);
-      const model = settings!.aiProvider === "azure" ? settings!.azureDalleDeployment! : "dall-e-3";
+      let coverImageUrl: string;
 
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      let response: any;
-      try {
-        response = await dalleClient.images.generate({
-          model,
-          prompt: finalPrompt,
-          size: "1024x1024",
-          n: 1,
-          response_format: "b64_json",
-        });
-      } catch (err) {
-        throw new TRPCError({
-          code: "INTERNAL_SERVER_ERROR",
-          message: `DALL-E error: ${parseAiError(err)}`,
-        });
+      if (useGemini) {
+        try {
+          coverImageUrl = await generateGeminiImage(
+            settings!.geminiApiKey!,
+            finalPrompt,
+            settings!.geminiModel ?? undefined,
+          );
+        } catch (err) {
+          throw new TRPCError({
+            code: "INTERNAL_SERVER_ERROR",
+            message: `Gemini error: ${parseGeminiError(err)}`,
+          });
+        }
+      } else {
+        const dalleClient = createDalleClient(settings!);
+        const model = settings!.aiProvider === "azure" ? settings!.azureDalleDeployment! : "dall-e-3";
+
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        let response: any;
+        try {
+          response = await dalleClient.images.generate({
+            model,
+            prompt: finalPrompt,
+            size: "1024x1024",
+            n: 1,
+            response_format: "b64_json",
+          });
+        } catch (err) {
+          throw new TRPCError({
+            code: "INTERNAL_SERVER_ERROR",
+            message: `DALL-E error: ${parseAiError(err)}`,
+          });
+        }
+
+        const b64 = response.data?.[0]?.b64_json;
+        if (!b64) {
+          throw new TRPCError({
+            code: "INTERNAL_SERVER_ERROR",
+            message: "No image data returned from DALL-E",
+          });
+        }
+
+        coverImageUrl = `data:image/png;base64,${b64}`;
       }
 
-      const b64 = response.data?.[0]?.b64_json;
-      if (!b64) {
-        throw new TRPCError({
-          code: "INTERNAL_SERVER_ERROR",
-          message: "No image data returned from DALL-E",
-        });
-      }
-
-      const coverImageUrl = `data:image/png;base64,${b64}`;
-
       await ctx.db.project.update({
         where: { id: input.projectId },
         data: { coverImageUrl },
@@ -552,11 +574,28 @@ export const projectRouter = createTRPCRouter({
       return { ok: true };
     }),
 
+  isImageGenConfigured: protectedProcedure
+    .query(async ({ ctx }) => {
+      const settings = await ctx.db.systemSettings.findUnique({
+        where: { id: "singleton" },
+      });
+      const imageProvider = settings?.imageProvider ?? "dalle";
+      const configured = imageProvider === "gemini"
+        ? isGeminiConfigured(settings)
+        : isDalleConfigured(settings);
+      return { configured, provider: imageProvider };
+    }),
+
+  /** @deprecated Use isImageGenConfigured instead */
   isDalleConfigured: protectedProcedure
     .query(async ({ ctx }) => {
       const settings = await ctx.db.systemSettings.findUnique({
         where: { id: "singleton" },
       });
-      return { configured: isDalleConfigured(settings) };
+      const imageProvider = settings?.imageProvider ?? "dalle";
+      const configured = imageProvider === "gemini"
+        ? isGeminiConfigured(settings)
+        : isDalleConfigured(settings);
+      return { configured };
     }),
 });