docs/ops: document Gemini TTS VPN requirement and unresolved 403 access

[AmirMotefaker]

Context

AvaYar's live Gemini TTS diagnostics were rerun from a VPN route in Istanbul, Turkey.

Observed results

• Public route: TR / Istanbul
• GEMINI_API_KEY loaded successfully for the test
• Gemini models metadata request: HTTP 403
• gemini-3.1-flash-tts-preview:generateContent: HTTP 403
• Live Persian speech probe exits with code 1
• Google response: client does not have permission to access the TTS generateContent URL

Important operational note

Some user/network locations may require a supported-country VPN/network route before using AvaYar Gemini speech. This should be documented for users and operators.

However, VPN must not be documented as a complete fix yet: the current test still receives 403 even through Turkey. The remaining blocker is likely API key / Google project / API access / account policy / model entitlement and must be isolated next.

Documentation requirement

Add a troubleshooting section to AvaYar docs that explains:

1. Gemini speech requires GEMINI_API_KEY.
2. In unsupported/restricted network regions, use a supported network/VPN route.
3. Verify the public egress country before testing.
4. A persistent 403 after switching routes means the user must check Gemini API key/project/access rather than modify AvaYar code.
5. Never commit API keys to the repository.

Acceptance criteria

• User-facing README/docs include the network/VPN prerequisite note without overstating it as a guaranteed fix.
• Operator troubleshooting includes the repo diagnostics (scripts/diagnose-gemini-ci-route.mjs and scripts/live-gemini-speech-probe.mjs).
• Persistent 403 classification points to key/project/access investigation.
• No production/runtime behavior is changed as part of documentation-only work.

Current status

Blocked on isolating Google Gemini API key/project access. Production remains unchanged.