fix: config validation hardening and integration polish

- providers.go: validate provider names against ^[a-zA-Z0-9._-]+$ and
  reject reserved names (v1, mcp, a2a) that would shadow gateway routes;
  reject nil ProviderConfig map values at construction instead of
  panicking.
- mcp_a2a.go: apply the same name-pattern and reserved-name validation to
  mcpServers/agents keys, and reject nil TargetConfig/AgentConfig map
  values at construction.
- auth.go: reject nil GroupConfig map values at construction.
- provider_openai_test.go, mcp_a2a_test.go, auth_test.go: table-driven
  constructor-error coverage for the above.
- integration/integration_test.go: point the package doc at
  `make integration-up`/`integration-keep` instead of a bare
  `docker compose up -d --build`, which skips the dynamic.yml.tmpl
  render step and can run against a stale or absent dynamic.yml; add
  max_tokens to the gemini chat request so translate_gemini.go's
  hasMaxTokens=true branch is actually exercised under real Yaegi.
- translate_gemini.go: soften the max_tokens comment's verification claim
  to match what the integration suite actually now exercises.

mcp_a2a_test.go

@@ -666,6 +666,36 @@ func TestNewGateway_TargetURLValidation(t *testing.T) {
 			agents:  map[string]*AgentConfig{"agent1": {URL: "http://agent1.internal:notaport"}},
 			wantErr: true,
 		},
+		{
+			name:       "nil mcpServers config value is a constructor error, not a panic",
+			mcpServers: map[string]*TargetConfig{"alpha": nil},
+			wantErr:    true,
+		},
+		{
+			name:    "nil agents config value is a constructor error, not a panic",
+			agents:  map[string]*AgentConfig{"agent1": nil},
+			wantErr: true,
+		},
+		{
+			name:       "mcpServers name reserved (v1) is a constructor error",
+			mcpServers: map[string]*TargetConfig{"v1": {URL: "http://mcp-alpha.internal:8080"}},
+			wantErr:    true,
+		},
+		{
+			name:       "mcpServers name reserved (mcp) is a constructor error",
+			mcpServers: map[string]*TargetConfig{"mcp": {URL: "http://mcp-alpha.internal:8080"}},
+			wantErr:    true,
+		},
+		{
+			name:    "agents name reserved (a2a) is a constructor error",
+			agents:  map[string]*AgentConfig{"a2a": {URL: "https://agent1.internal"}},
+			wantErr: true,
+		},
+		{
+			name:       "mcpServers name with invalid character is a constructor error",
+			mcpServers: map[string]*TargetConfig{"has a space": {URL: "http://mcp-alpha.internal:8080"}},
+			wantErr:    true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {