fix(knowledge): pass Gemini API key via x-goog-api-key header

URLs end up in server access logs, proxy logs, and APM tools, so embedding
the key as a query param risks accidental exposure. Google explicitly
recommends the header form for the Gemini REST API.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/lib/knowledge/embeddings.ts

@@ -154,9 +154,10 @@ function l2Normalize(vector: number[]): number[] {
 
 function buildGeminiProvider(modelName: string, apiKey: string): ResolvedProvider['buildRequest'] {
   return (inputs, inputType) => ({
-    apiUrl: `https://generativelanguage.googleapis.com/v1beta/models/${modelName}:batchEmbedContents?key=${encodeURIComponent(apiKey)}`,
+    apiUrl: `https://generativelanguage.googleapis.com/v1beta/models/${modelName}:batchEmbedContents`,
     headers: {
       'Content-Type': 'application/json',
+      'x-goog-api-key': apiKey,
     },
     body: {
       requests: inputs.map((text) => ({