feat(brain): add Gemini CLI OAuth path for STREAM_BROWSER=false real-time search

Adds a GEMINI_AUTH=oauth (default) sub-mode that shells out to the Gemini CLI
using the user's Google-account login instead of an API key. gemini_cli_search()
runs `gemini -p <query> -o json --skip-trust --approval-mode yolo`, strips
GEMINI_API_KEY/GOOGLE_API_KEY and sets GOOGLE_GENAI_USE_GCA=true so the CLI
selects the account OAuth method and fails fast when no login exists. Bounded by
a 30s timeout and fail-open to the DDG/Brave/Wikipedia cascade on any failure
(CLI missing, login expired, quota 429, timeout). GEMINI_AUTH=apikey keeps the
legacy REST path. Specs and docs/llm_contexts.md updated; behaviour covered by
tests/test_realtime_gemini_cli.py.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -60,8 +60,13 @@ CHROME_START_URL=about:blank
 #           on-screen browser for real-time info (search / play / read screen).
 #   false = no screen share; voice only, real-time info via the Gemini API.
 STREAM_BROWSER=true
-# Gemini account (used for real-time info when STREAM_BROWSER=false). Get a key
-# at https://aistudio.google.com/app/apikey and paste it here.
+# Gemini auth for real-time info when STREAM_BROWSER=false.
+#   oauth  = use the Gemini CLI with a Google-account login (no API key).
+#            Install once: npm i -g @google/gemini-cli ; then run `gemini` and
+#            "Sign in with Google". Uses the CLI's built-in web-search grounding.
+#   apikey = legacy REST path; needs GEMINI_API_KEY below
+#            (get one at https://aistudio.google.com/app/apikey).
+GEMINI_AUTH=oauth
 GEMINI_API_KEY=
 GEMINI_MODEL=gemini-2.0-flash