feat: Google Gemini image generation for project covers

Schema:
- SystemSettings: geminiApiKey, geminiModel, imageProvider fields
- imageProvider: "dalle" (default) or "gemini"

Gemini Client (packages/api/src/gemini-client.ts):
- Direct HTTP call to Gemini REST API with responseModalities: [TEXT, IMAGE]
- Returns base64 data URL
- Error parsing with user-friendly messages

Router (project.ts):
- generateCover: routes to DALL-E or Gemini based on imageProvider setting
- New isImageGenConfigured query returning { configured, provider }

Admin UI (SystemSettingsClient.tsx):
- "Image Generation" section with provider radio buttons (DALL-E / Gemini)
- Conditional fields: DALL-E config or Gemini API key + model
- Separate save button for image settings

Security:
- geminiApiKey sanitized in audit logs (SENSITIVE_FIELDS)
- API key stored server-side only, never sent to client

Co-Authored-By: claude-flow <ruv@ruv.net>

packages/db/prisma/schema.prisma

@@ -1447,6 +1447,10 @@ model SystemSettings {
   azureDalleDeployment    String?  // e.g. "dall-e-3" — Azure DALL-E deployment name
   azureDalleEndpoint      String?  // Optional: separate endpoint for DALL-E (if different from chat)
   azureDalleApiKey        String?  // Optional: separate API key for DALL-E
+  // Gemini image generation
+  geminiApiKey            String?
+  geminiModel             String?  @default("gemini-2.0-flash-preview-image-generation")
+  imageProvider           String?  @default("dalle")  // "dalle" | "gemini"
   updatedAt               DateTime @updatedAt
 
   @@map("system_settings")