Vault and renderer: Vertex project/region storage and cloud probe wiring #49

Why

Child of #15. The probe layer landed in #47 / PR #48, so runProbe() now dispatches aws, gcp and azure. The IPC handler in src/main/ipc.ts still only passes providerId, apiKey and baseUrl, so a saved Vertex key can never validate - the probe errors with project and region missing - and Bedrock probes are blocked by the handler requirement for an API key even though Bedrock reads the AWS env chain. The renderer Keys step also filters out providers with no envKeys, so Vertex never appears in Add key.

This child covers only the vault storage, IPC wiring and renderer Keys step for Vertex project and region, plus the Bedrock no-key probe path. CLI parity in cli/src/lib/probes.ts stays a separate PR in the independent CLI release flow.

Scope

• src/shared/secrets.ts - sibling vault ids for provider config fields, provider:<id>:project and provider:<id>:region, with parse helpers. Config entries are not API keys and must not render as key rows.
• src/main/probes/context.ts - pure helper that builds a ProbeContext from explicit probe request fields, falling back to stored vault config. Unit-testable without Electron.
• src/main/ipc.ts - probe handler resolves stored Vertex project and region from the vault when the request does not carry them, passes project and region into runProbe(), and lets Bedrock (cloud_creds, probeKind aws) probe without a vault API key.
• src/preload/api.ts - ProbeRequest gains optional project and region.
• Renderer Keys step in src/renderer/App.tsx - Vertex appears in Add key, the enter step asks for project id, region and access token before Save, saving writes the API key plus the project and region sibling secrets, deleting a Vertex key also deletes its config siblings, and vault config entries never show as key rows.
• Tests for the secret id helpers and the probe context resolution, with no live provider keys.

Out of scope

• CLI parity in cli/src/lib/probes.ts (separate CLI PR).
• Bedrock credential entry in the renderer. Bedrock still uses the AWS env chain, this slice only unblocks its Validate probe.
• Azure endpoint fields beyond the existing base URL handling.
• Live Bedrock or Vertex verification, which needs real cloud credentials and stays a reviewer note.

Acceptance criteria

• Saving a Vertex key stores provider:vertex:api_key, provider:vertex:project and provider:vertex:region, and the project and region entries do not appear as key rows.
• Probing a saved Vertex key passes the stored project and region into runProbe(); explicit request fields win over stored values.
• Probing Bedrock without a vault API key reaches the aws probe instead of failing with no API key available.
• Unit tests cover the new secret id helpers and probe context resolution, and run under npm test.
• mise run ci:app green. No live provider call is made in tests.