v2026.08.23.8
Native Gemini generateContent / streamGenerateContent ingress.
Accept tenant virtual keys from x-goog-api-key and route native Gemini requests to Gemini suppliers with byte-for-byte protocol preservation. The caller's Gemini body reaches the supplier untouched (UpstreamPlan.nativeBody); buffered bytes and SSE frames relay through a null normalizer. FerroGate owns auth, routing, metering and the credential swap — the tenant key is never forwarded (supplier x-goog-api-key written by the gateway; only x-goog-api-client passes through). A non-Gemini supplier is refused with 502 provider_protocol_mismatch rather than mis-served.
Also fixes a prompt_cache control-member leak on the native Anthropic passthrough.