fix(firestore-genai-chatbot): validate conditional config combinations at first invocation

Rescoped from "restore startup fail-fast". The extension ran `validateRequiredEnvVars()` at module load; the kit resolves config lazily on first invocation. Most of that validation is now the CLI's job: kit config flows through `firebase-functions/params`, which enforces required params and bound secrets at deploy time, so wholesale eager validation would duplicate the CLI and fight the side-effect-free `./lib` entry point. That relocation gets a Notes entry (#3035).

The remaining gap is conditional requirements, which params cannot express: "if PROVIDER is openai then OPENAI_API_KEY is required". Today such a combo deploys green and fails on the first user request with a provider SDK stack trace. #3009 is the same root cause shipping as a real bug in firestore-send-email.

Fix: validate cross-field combinations in `resolveConfig` so the first invocation fails with a message naming the missing param. Follow whatever convention the #3009 fix establishes; keep it a per-kit implementation with a shared convention, not a framework.

Parity ledger: #2974.