feat(gcp): add Vertex AI embed support and TokenProvider injection

[atharva-nagane]

Closes #158

Refactored VertexAiProvider to hold Arc<dyn TokenProvider> instead of calling retrieve_token() directly. The production new() constructor creates a ServiceAccountTokenProvider; the new with_http_client() test constructor accepts any TokenProvider implementation. get_token() is now pub(crate) and handles proactive refresh (TTL < 5 min) with thundering-herd protection — the tokio::sync::Mutex is held across the async refresh call so concurrent requests don't all trigger a refresh simultaneously.

Implemented embed() using the text-embedding-004:predict endpoint. Added pub(crate) helpers build_embed_request and parse_embed_response for direct unit testing. Empty input returns early without a network round-trip.

45 tests pass.