fix(provider): validate current provider ID existence before use

Add get_effective_current_provider() to validate local settings ID
against database, with automatic cleanup and fallback to DB is_current.

This fixes edge cases in multi-device cloud sync scenarios where local
settings may contain stale provider IDs:

- current(): now returns validated effective provider ID
- update(): correctly syncs live config when local ID differs from DB
- delete(): checks both local settings and DB to prevent deletion
- switch(): backfill logic now targets valid provider
- sync_current_to_live(): uses validated ID with auto-fallback
- tray menu: displays correct checkmark on startup

Also fixes test issues:
- Add missing test setup calls (mutex, reset_test_fs, ensure_test_home)
- Correct Gemini security settings path to ~/.gemini/settings.json

src-tauri/src/lib.rs

@@ -221,16 +221,12 @@ fn create_tray_menu(
         let app_type_str = section.app_type.as_str();
         let providers = app_state.db.get_all_providers(app_type_str)?;
 
-        // 优先从本地 settings 读取当前供应商，fallback 到数据库
-        let current_id = crate::settings::get_current_provider(&section.app_type)
-            .or_else(|| {
-                app_state
-                    .db
-                    .get_current_provider(app_type_str)
-                    .ok()
-                    .flatten()
-            })
-            .unwrap_or_default();
+        // 使用有效的当前供应商 ID（验证存在性，自动清理失效 ID）
+        let current_id = crate::settings::get_effective_current_provider(
+            &app_state.db,
+            &section.app_type,
+        )?
+        .unwrap_or_default();
 
         let manager = crate::provider::ProviderManager {
             providers,