docs: warn that personal Google login is blocked on the Gemini CLI path

Google now rejects personal Google accounts on the Gemini CLI OAuth login
("This client is no longer supported for Gemini Code Assist for individuals").
The setup docs previously sent every user down "Sign in with Google" with no
warning. Note the block, recommend GEMINI_AUTH=apikey for personal accounts,
and clarify that real-time search fail-opens to DDG/Brave/Wikipedia regardless.

Docs only; no runtime default change.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -102,8 +102,15 @@ STREAM_BROWSER=true
 #   oauth  = use the Gemini CLI with a Google-account login (no API key).
 #            Install once: npm i -g @google/gemini-cli ; then run `gemini` and
 #            "Sign in with Google". Uses the CLI's built-in web-search grounding.
-#   apikey = legacy REST path; needs GEMINI_API_KEY below
-#            (get one at https://aistudio.google.com/app/apikey).
+#            NOTE (2026-06): Google is blocking personal Google accounts on this
+#            path ("This client is no longer supported for Gemini Code Assist for
+#            individuals"). Workspace/org accounts may still work; personal
+#            accounts should use apikey below instead.
+#   apikey = REST path; needs GEMINI_API_KEY below
+#            (get one at https://aistudio.google.com/app/apikey). Recommended for
+#            personal Google accounts now that individual OAuth login is blocked.
+# Either way, real-time search fail-opens to DDG/Brave/Wikipedia if Gemini is
+# unavailable, so this is optional, not required.
 GEMINI_AUTH=oauth
 GEMINI_API_KEY=
 GEMINI_MODEL=gemini-2.0-flash

docs/DEPLOY.md

@@ -68,6 +68,11 @@ human-style input (visible on its VNC).
   compose runs from PowerShell/cmd). Seed it once from a machine with a browser and
   the logged-in Gemini CLI (`npm i -g @google/gemini-cli`, then `gemini` ->
   "Sign in with Google"), copying the login state:
+  (Note: as of 2026-06 Google blocks personal Google accounts on this CLI login
+  with "This client is no longer supported for Gemini Code Assist for
+  individuals". Workspace/org accounts may still work; personal accounts should
+  use `GEMINI_AUTH=apikey` with a key from https://aistudio.google.com/app/apikey
+  instead. Real-time search fail-opens to DDG/Brave/Wikipedia either way.)
   `cp -r ~/.gemini/. docker/gemini-oauth/`. The essential file is `oauth_creds.json`
   (it holds the refresh token; `GOOGLE_GENAI_USE_GCA=true` forces OAuth, so that is
   the file the startup readiness check looks for) - copying the whole dir simply also