[johnnyhuy]

This stores the Vertex GCP project and region in the vault beside the access token and wires them into the probe, so a saved Vertex key can validate through the Keys step. Bedrock can also probe without a vault key, since it reads the AWS env chain.

Closes #49
Refs #15

Verification

• mise run ci:app passed in this worktree (catalog check, typecheck, lint, unit tests including the new secret id and probe context cases, and the full build).
• mise run ci:cli passed (typecheck and compiled CLI build). The CLI is untouched in this PR, because cli/src/lib/probes.ts is a separate implementation and CLI parity stays a follow-up in the independent CLI flow.
• The new tests first failed against the pre-change build with secretIdForProviderConfig is not a function and dist/main/probes/context.js missing, then passed after the implementation and rebuild.

Proof is from a logic-only slice with no live provider keys. The Electron app was not launched for a screenshot in this headless run, so the proof below is the unit test output that runs under npm test.

  ✓ vertex project secret id
  ✓ vertex region secret id
  ✓ parse vertex project config id
  ✓ parse vertex region config id
  ✓ api_key is not a config id
  ✓ config id does not parse as api_key
  ✓ stored project is used when explicit is missing
  ✓ stored region is used when explicit is missing
  ✓ explicit project wins over stored
  ✓ explicit region wins over stored
  ✓ blank explicit project falls back to trimmed stored
  ✓ blank stored project becomes undefined
  ✓ aws probe does not require a vault api key
  ✓ gcp probe requires a token

all secrets cases passed
all probe context cases passed
all cloud probe cases passed

Reviewer notes

• No live Bedrock or Vertex call was made. Confirming a Vertex probe against a real GCP project still needs a real access token from ADC, a real project id and a real region.
• Vertex config lives in sibling vault entries provider:vertex:project and provider:vertex:region. They use the same safeStorage backend as the API key, they never render as key rows, and deleting the Vertex key deletes them too.
• Bedrock keeps using the AWS env chain. This slice only removes the vault key requirement in front of its probe, it does not add Bedrock credential fields to the renderer.
• The parent issue Probe Bedrock and Vertex provider keys (ADR-0003 follow-up) #15 stays open. CLI probe parity and any live-key check remain for later runs.