feat(geminicli): 添加内置 Gemini CLI OAuth 客户端常量和改进配置逻辑

- 添加 GeminiCLIOAuthClientID/Secret 常量（Gemini CLI 公开 OAuth 客户端）
- 更新 DefaultAIStudioScopes 使用 generative-language.retriever（符合 Google 文档）
- EffectiveOAuthConfig 支持自动回退到内置客户端
- 内置客户端自动过滤受限 scope（如 generative-language）
- 添加 scope 向后兼容性处理

backend/internal/pkg/geminicli/constants.go

@@ -22,11 +22,19 @@ const (
 	// DefaultScopes for AI Studio (uses generativelanguage API with OAuth)
 	// Reference: https://ai.google.dev/gemini-api/docs/oauth
 	// For regular Google accounts, supports API calls to generativelanguage.googleapis.com
-	DefaultAIStudioScopes = "https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/generative-language"
+	// Note: Google Auth platform currently documents the OAuth scope as
+	// https://www.googleapis.com/auth/generative-language.retriever (often with cloud-platform).
+	DefaultAIStudioScopes = "https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/generative-language.retriever"
 
 	// GeminiCLIRedirectURI is the redirect URI used by Gemini CLI for Code Assist OAuth.
 	GeminiCLIRedirectURI = "https://codeassist.google.com/authcode"
 
+	// GeminiCLIOAuthClientID/Secret are the public OAuth client credentials used by Google Gemini CLI.
+	// They enable the "login without creating your own OAuth client" experience, but Google may
+	// restrict which scopes are allowed for this client.
+	GeminiCLIOAuthClientID     = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com"
+	GeminiCLIOAuthClientSecret = "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"
+
 	SessionTTL = 30 * time.Minute
 
 	// GeminiCLIUserAgent mimics Gemini CLI to maximize compatibility with internal endpoints.