fix(gemini): prevent 400 by filtering proxy-generated IDs from thought_signature

- Only restore thought_signature if the tool call ID doesn't start with 'call_'.
- This ensures proxy-generated UUIDs are never sent back to Gemini as signatures, which was causing base64 decoding failures.

src/providers/gemini.rs

@@ -309,8 +309,10 @@ impl GeminiProvider {
                         let args = serde_json::from_str::<Value>(&tc.function.arguments)
                             .unwrap_or_else(|_| serde_json::json!({}));
                         
-                        // RESTORE: Use tc.id as thought_signature if it was originally one
+                        // RESTORE: Use tc.id as thought_signature if it was originally one.
-                        let thought_signature = if tc.id.starts_with("sig_") || !tc.id.contains('-') {
+                        // We skip our own generated IDs (which start with 'call_') 
+                        // because they are not valid base64-encoded Gemini signatures.
+                        let thought_signature = if !tc.id.starts_with("call_") {
                             Some(tc.id.clone())
                         } else {
                             None