fix: use allowlist for Gemini native request fields to prevent 400

Fixes #130

The inbound normalizer forwarded all unknown top-level fields to Gemini
API. Client-specific fields like requestId caused upstream 400 errors.

Changed from blocklist (only 3 entries) to allowlist of known Gemini API
fields: contents, systemInstruction, cachedContent, safetySettings,
generationConfig, tools, toolConfig, labels, model.

src/server/transformers/gemini/generate-content/inbound.ts

@@ -194,14 +194,22 @@ export const geminiGenerateContentInbound = {
       next.generationConfig = generationConfig;
     }
 
-    const strippedKeys = new Set([
+    // Only forward fields that Gemini API supports. Unknown fields
-      'reasoning',
+    // (e.g. requestId, frequency_penalty) cause upstream 400 errors.
-      'reasoning_effort',
+    const allowedPassthroughKeys = new Set([
-      'reasoning_budget',
+      'contents',
+      'systemInstruction',
+      'cachedContent',
+      'safetySettings',
+      'generationConfig',
+      'tools',
+      'toolConfig',
+      'labels',
+      'model',
     ]);
 
     for (const [key, value] of Object.entries(body)) {
-      if (strippedKeys.has(key)) continue;
+      if (!allowedPassthroughKeys.has(key)) continue;
       if (next[key] !== undefined) continue;
       next[key] = cloneJsonValue(value);
     }