docs: Google APIs with a federated credential

[aojea]

Guide only (an earlier revision of this PR also changed agentmesh-one to trust X-Forwarded-Proto for the OIDC issuer; that is withdrawn, see the linked issue).

site/content/docs/guides/google-cloud-credentials.md: a mesh member calls Gemini on Vertex AI and an agent on Agent Engine through an egress node with Workload Identity Federation. The pool and OIDC provider that trust the control plane, the service account, the egress entry with oidc_federation and one http grant narrowed to POST on the model and engine paths, the call, two refusals (method, path), and what the node's audit line and Google's GenerateAccessToken audit entry show. No service account key exists anywhere.

Behind a TLS-terminating proxy the control plane does not infer its issuer scheme from forwarded headers (e67f5eab); the guide says to set the public URL (--external-url on agentmesh-one, --sts-issuer-url on agentmesh-control-plane).

Verified on a Cloud Run hub (v0.1.1, --external-url) with serving nodes on GKE, from an OpenShell sandbox and from a Substrate actor; the tutorial in #747 has the make gemini targets that run it.

[gemini-code-assist]

Code Review

This pull request configures the standalone server to trust forwarded headers, allowing it to correctly infer its OIDC issuer URL when deployed behind a TLS front door like Cloud Run. It also adds a comprehensive guide on accessing Google APIs using federated credentials and introduces an integration test to verify the issuer inference behavior. The review feedback suggests fixing malformed placeholders in the new documentation guide and adding a status code assertion in the integration test helper to ensure robust error reporting.

[gemini-code-assist]

The placeholders for the Biscuit token and the access token are missing their opening angle brackets (<), resulting in malformed placeholders like ****** member's Biscuit> and ****** token>. Adding the opening brackets makes the documentation clearer and consistent with other placeholders in the guide.

Suggested change

	X-Mesh-Authentication: ****** member's Biscuit>
	node authorizes: role grants egress://aiplatform.googleapis.com, POST, this path
	POST <control plane>/sts/token -> ES256 JWT: iss=<control plane>, sub=<member>, aud=<WIF provider>
	POST https://sts.googleapis.com/v1/token -> federated token
	POST iamcredentials ...:generateAccessToken (impersonate) -> access token
	POST https://aiplatform.googleapis.com/v1/.../gemini-2.5-flash:generateContent
	Authorization: ****** token>
	X-Mesh-Authentication: ****** <member's Biscuit>
	node authorizes: role grants egress://aiplatform.googleapis.com, POST, this path
	POST <control plane>/sts/token -> ES256 JWT: iss=<control plane>, sub=<member>, aud=<WIF provider>
	POST https://sts.googleapis.com/v1/token -> federated token
	POST iamcredentials ...:generateAccessToken (impersonate) -> access token
	POST https://aiplatform.googleapis.com/v1/.../gemini-2.5-flash:generateContent
	Authorization: ****** <token>

[gemini-code-assist]

Assert that the HTTP response status code is 200 OK before attempting to decode the response body. If the server returns a non-200 error status (e.g., 404 or 500), attempting to decode the body as JSON will fail with a confusing decoding error (like EOF or invalid character '<'), masking the actual HTTP failure.

		resp, err := http.DefaultClient.Do(req)
		if err != nil {
			t.Fatalf("GET openid-configuration: %v", err)
		}
		defer func() { _ = resp.Body.Close() }()
		if resp.StatusCode != http.StatusOK {
			t.Fatalf("GET openid-configuration status = %s, want 200", resp.Status)
		}