fix(firestore-vector-search): bind provider secrets to task functions

[CorieW]

Summary

• Binds GEMINI_API_KEY / OPENAI_API_KEY to updateTask, backfillTask, updateTrigger, and backfillTrigger — tracked in Kits parity issues #2974 (ranked [FR] only storing resized image #4): these all reach getSingleEmbedding, so a gemini/openai backfill previously read an undefined key.
• Secrets ride on DEFAULT_TASK_OPTIONS / EMBEDDING_TASK_OPTIONS, matching the existing Firestore/callable bindings.
• initVectorSearch's explicit secrets spread becomes redundant and is simplified to DEFAULT_TASK_OPTIONS.

Testing

• tsc --noEmit clean; all 49 tests pass.
• Wire-level verification (endpoint secretEnvironmentVariables on the task functions) is covered by the consumer-project repack/deploy pass.
• End-to-end against a consumer project: kit rebuilt from this branch, npm packed, re-vendored; discovery endpoint specs show both secrets on all 8 endpoints, including the four previously-unbound task/trigger functions.
• Live deploy of all three vector-search codebases (a91f6c2e, euclid, openai) — successful updates, secret versions validated, lifecycle initVectorSearch tasks queued, 0 failures.
• Cloud-side verification via firebase functions:list: 24/24 vector-search functions across the three instances carry both GEMINI_API_KEY and OPENAI_API_KEY, pinned to real Secret Manager versions.

[gemini-code-assist]

Code Review

This pull request refactors the task options in the Firestore Vector Search kit to include the required API secrets directly in the default and embedding task options, simplifying the task dispatch configurations. A review comment suggests refining the newly added comment to clarify that the secrets are needed for configuration resolution during initialization, preventing potential confusion for future maintainers.