DP-1470: migrate Ash Gemini auth from API key to GCP Service Account + bump Ash to 1.9.0

[pwildber]

Summary

Migrates the Jeff/Ash AI assistant from GEMINI API key auth to GCP Service Account (JWT/RS256) flow, and bumps Ash to 1.9.0.

Changes

• Ash image: ai-ash-1.7.0 → ai-ash-1.9.0
• Gemini auth: Replaced GEMINI_ENDPOINT / GEMINI_API_KEY with PROJECT_ID, GEMINI_REGION, and GCP Service Account JSON (GCP_S_A_CREDENTIALS)
• check_gemini_api(): Rewritten to perform full GCP SA JWT (RS256) token exchange via Google OAuth2, then calls Vertex AI generateContent API
• prompt_jeff_config(): Updated prompts for GCP Project ID, region, and SA JSON key paste
• configure_jeff_file(): Replaces old Gemini endpoint/key sed ops with new GCP fields; inlines SA JSON into compose via Python
• validate_preserved_values() / capture_preserved_values(): Updated key names to match new flow
• preflight.sh: Updated Jeff AI credential checks accordingly
• Jeff compose templates: Updated env var placeholders for both Docker and Podman
• AGENTS.md: Added (was missing from repo)