Google GenAI embedding: `credentials-uri` is read and silently ignored in `GoogleGenAiEmbeddingConnectionAutoConfiguration` (falls back to ADC)

Bug description

In GoogleGenAiEmbeddingConnectionAutoConfiguration (2.0.0), the credentials referenced by spring.ai.google.genai.credentials-uri are loaded and then never used: the local variable is dead code, and the input
stream is never closed. The embedding connection silently falls back to Application Default Credentials.

Two failure modes:

• with no ADC in the environment, embedding calls fail exactly as if the property had never been set;
• worse, with an ADC present that belongs to a different account than the configured one, the connection silently works with the wrong account.
  An application may legitimately run several Google clients with different service accounts (e.g. one for Vertex AI chat, others for OCR/TTS) and switch accounts per concern; a process-global ADC cannot express that, credentials-uri exists precisely for this, but for embeddings it has no effect.

The chat autoconfiguration has a related but different credentials-uri defect (credentials applied but unscoped), already tracked in #6595 with fix PR #6596; that PR does not touch the embedding autoconfiguration.
See also #5242 for the 1.1.x chat path. This report is only about the embedding connection.

Environment

• Spring AI 2.0.0 (spring-ai-starter-model-google-genai, via spring-ai-bom:2.0.0)
• Spring Boot 4.1.0
• Java 17 (Temurin), Windows and Linux
• Google GenAI in Vertex AI mode (project-id + location set), service-account key JSON referenced by spring.ai.google.genai.credentials-uri

Steps to reproduce

1. Configure Vertex AI mode with an explicit service-account key and no GOOGLE_APPLICATION_CREDENTIALS in the environment:

   spring.ai.google.genai.project-id=<project>
   spring.ai.google.genai.location=europe-west1
   spring.ai.google.genai.credentials-uri=file:/path/to/service-account.json
   

2. Call the autoconfigured Google GenAI EmbeddingModel once.

3. The call fails with the standard "Application Default Credentials are not available" error, i.e. exactly as if credentials-uri had not been set. Setting GOOGLE_APPLICATION_CREDENTIALS (even to a different service account) makes the call proceed with that account instead, proving the configured property is ignored.

Expected behavior

The credentials loaded from credentials-uri should be applied to the embedding connection (scoped to cloud-platform, consistently with the chat-side fix in #6596). Alternatively, if the property is intentionally unsupported for embeddings, the dead read should be removed and the limitation documented.

Minimal Complete Reproducible example

The defect is visible by inspection in the 2.0.0 sources of googleGenAiEmbeddingConnectionDetails(...):

if (connectionProperties.getCredentialsUri() != null) {
    GoogleCredentials credentials = GoogleCredentials
        .fromStream(connectionProperties.getCredentialsUri().getInputStream());
    // Note: Credentials are handled automatically by the SDK when using
    // Vertex AI mode
}

credentials is a dead local: it is never passed to connectionBuilder, no credentials(...) call exists on this path, and the stream is leaked.
At runtime, any Spring Boot 4.1 app with the three properties above and no ADC fails its first embedding call with the ADC-not-found error, while the same key works when exported as GOOGLE_APPLICATION_CREDENTIALS, confirming the property is read but ignored.

Workaround

Export the service account as GOOGLE_APPLICATION_CREDENTIALS for the whole process (acceptable only when every Google client in the app uses the same account), or bypass the autoconfigured connection details with a
custom bean.

Start in GoogleGenAiEmbeddingConnectionAutoConfiguration at googleGenAiEmbeddingConnectionDetails(...), where credentials-uri is read before the connectionBuilder is configured. Trace how the chat-side fix in #6596 applies credentials, then ensure the embedding connection uses the configured credentials with cloud-platform scope and closes the input stream. Done means an embedding call uses credentials-uri without ADC.