admin_auth_token vault + EF gemini-call v8 vault-backed