fix(providers): keep Gemini API keys out of URLs (#9973)