fix(proxy): omit quota-project headers from content requests

[buluw]

Summary

Prevent content-generation requests from sending x-goog-user-project while preserving the project value in the request body.

The Cloud Code PA service is access-controlled and is not a normal API that arbitrary caller projects can enable. A manually verified control request returned 403 PERMISSION_DENIED / SERVICE_DISABLED when the header was present and succeeded with HTTP 200 after removing only that header.

Closes #3350.

Changes

• Do not derive x-goog-user-project from body.project for generateContent or streamGenerateContent.
• Remove the header from content requests even when supplied through extra headers.
• Preserve body.project unchanged.
• Preserve existing header behavior for non-content methods.

Validation

• cargo check --manifest-path src-tauri/Cargo.toml --offline --lib
• Manually verified the header's independent 403/200 effect with the same authenticated service request.
• A direct generateContent integration comparison is not claimed; the code path is verified from request construction and fallback logic.

Compatibility

• No public request schema changes.
• Non-content request behavior remains unchanged.
• The exact Google allowlist mechanism is undocumented and is not assumed by this change.