Server-side proxy so the Google API key (from Infisical) never reaches the
client. Behind an AiClient trait with a fake for headless tests.
- ai.rs: GeminiClient — refine prompt (gemini-2.5-flash), generate image
(gemini-2.5-flash-image / "nano-banana"), and async video (veo-2.0:
predictLongRunning → poll → proxy the redirecting download). DisabledAiClient
when no key is configured.
- POST /v1/ai/refine, /v1/ai/image (rate-limited 60/h, 20/h)
- POST /v1/ai/video (submit, 5/h) + /v1/ai/video/status (poll → base64 mp4)
- config: GEMINI_API_KEY via SecretSource
- 5 endpoint/parse tests; full workspace gate green (114 tests)
Live-verified: refine + nano-banana return through the proxy; Veo submits,
polls to done in ~60s, and streams back a valid mp4.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
