feat: Google Gemini subscription support

[brunobuddy]

Summary

• Add browser-based Google OAuth flow for connecting Gemini subscriptions
• Backend GeminiAuthService handles OAuth token exchange and access token refresh with in-memory cache
• Backend GeminiAuthController provides /api/v1/routing/gemini-auth (start) and /callback endpoints
• Proxy exchanges stored refresh tokens for fresh access tokens before forwarding to Gemini (both primary and fallback paths)
• Google subscription auth uses Authorization: Bearer header instead of ?key= query parameter
• Frontend shows "Sign in with Google" button in subscription tab with popup OAuth flow
• Popup blocker detection, origin-validated postMessage, and automatic cleanup on popup close

Test plan

• Backend unit tests: 2364 passed (132 suites)
• Frontend tests: 1398 passed (73 suites)
• 100% line coverage on all new/modified source files
• TypeScript compiles with no errors (backend + frontend)
• Linter passes (pre-commit hooks)
• E2E tests (require DATABASE_URL — pre-existing config issue)
• Manual test: connect Gemini subscription via OAuth popup
• Manual test: proxy routes to Gemini using subscription token
• Manual test: disconnect Gemini subscription

---

Summary by cubic

Adds Gemini subscription support via Google Code Assist with a popup PKCE OAuth flow. Subscription requests now use Bearer tokens and target the Code Assist API; tokens auto-refresh and responses are unwrapped for clients.

• New Features

  • OAuth: /api/v1/oauth/gemini/authorize and /api/v1/oauth/gemini/revoke with PKCE; defaults to Gemini CLI client; stores a token blob with project ID and auto-refresh.
  • Proxy: routes subscription calls to Code Assist (v1internal:generateContent) with Authorization: Bearer (no ?key=); unwraps the Code Assist response envelope (streaming and non‑streaming).
  • Model discovery: for Gemini subscriptions, uses a 5‑model whitelist and ignores previews/dated/Gemma variants.
  • Frontend: provider‑aware popup in the Subscription tab (“Sign in with Google”), revoke support, and generic /oauth/*/done popup completion; disconnect flows updated.
  • Tests: added backend and frontend coverage for OAuth, proxy routing, model discovery, and UI.

• Migration

  • Set GOOGLE_GEMINI_CLIENT_ID and GOOGLE_GEMINI_CLIENT_SECRET to enable OAuth (falls back to the Gemini CLI defaults if present).
  • No changes needed for API‑key Gemini setups.

^{Written for commit 7ba0cef. Summary will update on new commits.}