feat(server): wire GatedProvider into HTTP chat paths (#649)

[kiannidev]

Closes #649

Part of #569 (gated optional API provider).

Summary

• Add gated_provider_for_http to build a runtime GatedProvider from agent + optional-provider config
• Store provider gate config on ChatServer via with_provider_gate
• Route /api/chat and stream tool-finalize paths through the gated provider instead of LocalProvider::new
• Return HTTP 503 with a clear error when optional API is enabled but misconfigured (before LLM work starts)

Remote HTTP client routing remains a follow-up under #569.

Real Behavior Proof

• I have built and run the affected code locally.
• I have verified the change end-to-end on Jetson hardware.
• I have NOT verified on Jetson hardware, and I explain the equivalent verification path below.

Tested profile / hardware:

• laptop (x86_64 Linux dev host)

What I ran

cargo test -p genie-core provider
cargo clippy -p genie-core --all-targets -- -D warnings
cargo fmt --all -- --check

What I observed

• gated_provider_for_http_defaults_to_local_gate and existing gated-provider tests pass.
• Clippy and fmt clean.

Test plan

• provider_test::gated_provider_for_http_defaults_to_local_gate
• provider_test::gated_provider_gate_off_* / gated_provider_key_missing_*
• cargo clippy -p genie-core --all-targets -- -D warnings

[matedev01]

Reviewed — this is the C1/C2 wiring we want (GatedProvider into the HTTP chat paths, #569), building on the merged #639/#648. But it's now conflicting with main (server.rs, from the #648 escalation merge). Please rebase onto current main and I'll merge — the approach is right.