fix(gemini): preserve thoughtSignature via tool_call ID smuggling + fix ELOCKED mutex

- Encode thoughtSignature into tool_call.id using _TSIG_ delimiter and base64url
- Decode _TSIG_ on request to restore thoughtSignature for Gemini multi-turn thinking
- Track pendingThoughtSignature across parts for deferred signature attachment
- Add LocalMutex (2-layer locking) to prevent ELOCKED on concurrent DB access
- Increase lockfile retries from 5 to 15 for multi-process robustness
- Restore db.json seed on first run to prevent ENOENT on lockfile.lock
- Use process.env.BASE_URL fallback in models test route
- Remove gemini-3-flash-lite-preview from provider models

Co-authored-by: kwanLeeFrmVi <quanle96@outlook.com>
Closes #450

Made-with: Cursor

src/app/api/models/test/route.js

@@ -7,8 +7,8 @@ export async function POST(request) {
     const { model } = await request.json();
     if (!model) return NextResponse.json({ error: "Model required" }, { status: 400 });
 
-    const url = new URL(request.url);
-    const baseUrl = `${url.protocol}//${url.host}`;
+    const baseUrl = process.env.BASE_URL ||
+      (() => { const u = new URL(request.url); return `${u.protocol}//${u.host}`; })();
 
     // Get an active internal API key for auth (if requireApiKey is enabled)
     let apiKey = null;