Fix Gemini access and add Real World Reasoning Lab

[ryanbaumann]

What changed

• fixes Hairstyle AI Studio with five successful hosted image generations per IP per UTC day, a 100-generation process-wide daily ceiling, free recommendation analysis, and a validated memory-only Gemini key that bypasses shared spend limits
• imports Real World Reasoning Agent as a first-party open-source Fieldwork Lab with pinned provenance, current Gemini models, namespaced Maps/Gemini routes, canonical Fieldwork links, and a return CTA
• features both demos on the homepage, redirects legacy Atlas URLs, and uses an honest app preview
• adds an editable LinkedIn draft for the five-free-generations update; merge-time automation stages it in Buffer without publishing
• updates compatible dependencies with a clean audit

Root cause

Hairstyle applied its shared limiter before credential selection, so a personal key could still be blocked by shared quota. The imported reasoning demo also carried standalone gateway, analytics, and cost assumptions that needed Fieldwork-native controls.

Security and cost controls

• exact Google Maps upstream route/method and Gemini model allowlists
• separate per-IP policies plus process-wide UTC-day Maps/Gemini ceilings and bounded limiter memory
• malformed BYOK keys fail closed; visitor keys remain tab-memory-only and never enter URLs, storage, logs, or analytics
• cross-site Fetch Metadata rejection and pinned Places photo-media URLs
• shared canonical-host analytics with ad signals denied and query/referrer sanitization
• documented Cloud Run/XFF/restart assumptions, CSP, every key name and required restriction, cloud quota backstops, and regression commands in docs/LABS_SECURITY.md
• Grounding Lite remains an explicit operator opt-in; use a separately restricted GMP_MCP_KEY before setting RWR_GROUNDING_LITE_ENABLED=true

Validation

• Gateway: 141 tests passed
• Hairstyle: 9 tests and production build passed
• Real World Reasoning: 573 Vitest + 2 Node tests and production build passed
• Portfolio build tests: 33 passed
• Labs tests: 47 passed
• Social draft tests: 8 passed
• Local skill gate: 9 skills validated; 5 regression tests passed
• Container-equivalent full build: passed
• Staged gateway smoke and secret scan: 20/20 passed
• npm audit: zero vulnerabilities

No live or paid provider calls were made during validation. The in-memory daily controls reset on restart, so the documented Google Cloud/Gemini per-API quotas remain the hard distributed cost backstop.