fix: live Gemini mode works + GCP deploy path validated

[madhyamakist]

Summary

Turns the boilerplate from stub-only into a live, deployable agent and fixes the GCP deploy path.

Live LLM mode (verified with a real Gemini call)

• backend/app/config.py: env_file is now a tuple (./.env, ../.env) so the API key loads whether you run from the repo root or backend/.
• backend/app/agent.py: builds the chat endpoint per provider. Gemini's OpenAI-compat path is <base>/chat/completions (base already ends in /openai); generic OpenAI uses /v1/chat/completions. Fixes the 404 from a doubled /v1.
• Default model bumped gemini-1.5-flash → gemini-2.5-flash (1.5-flash is retired for the key). .env.example updated.
• backend/tests/test_chat.py::test_chat_stub no longer asserts stub content, so it passes in both stub and live mode.
• Verified: /api/chat and /goals/{id}/run return real Gemini 2.5-flash replies.

GCP deploy path (validated)

• deploy/cloudbuild.yaml pushes to Artifact Registry us-central1-docker.pkg.dev/<proj>/demo-agent/demo-agent-backend:latest (matches where the image is published).
• deploy/gcp-vm-startup.sh pulls from Artifact Registry (REGION/AR_REPO/IMAGE overridable) instead of the non-existent gcr.io path.
• deploy/terraform/main.tf firewall adds source_ranges=["0.0.0.0/0"] (required by GCP). terraform plan is clean (2 to add).
• .gitignore now excludes terraform state + provider cache.

Notes

• The live evals/test_agent.py::test_live_chat now runs for real when a key is present; the monthly-cap rule still holds (one call, not looped).
• .env (with the real key) is git-ignored and never committed.
• GCP Application Default Credentials need an interactive re-auth for terraform's provider, so the VM was provisioned via gcloud compute instances create (which uses the working gcloud auth) instead. Run gcloud auth application-default login before using terraform apply.

Test plan

• backend pytest tests → 6 passed (live key present)
• pytest evals → 5 passed (live call real)
• local server: /api/chat + /goals/{id}/run return real replies
• docker compose up --build healthy
• image pushed to Artifact Registry
• terraform plan clean (2 to add)
• VM created via gcloud (startup script pulls AR image)