docs(deploy): 说明 AI Studio OAuth Client 需发布为正式版本

README.md:
- 添加第 7 步：发布 OAuth 应用到正式版本
- 说明 Testing 模式限制（100 用户、7 天 token 过期）
- 说明 sensitive scope 可能需要 Google 审核

.env.example:
- 添加 OAuth Client 需发布为正式版本的说明

deploy/.env.example

@@ -67,14 +67,18 @@ JWT_EXPIRE_HOUR=24
 #
 # 2. AI Studio OAuth (不需要 project_id)
 #    - Uses: generativelanguage.googleapis.com (AI Studio API)
-#    - Default scopes: cloud-platform (+ userinfo.*)
-#    - OAuth Client: Leave empty to use built-in Gemini CLI client; or provide your own.
-#    - Requires: Create OAuth 2.0 Client in GCP Console
+#    - Default scopes: generative-language
+#    - OAuth Client: Requires your own OAuth 2.0 Client (内置 Gemini CLI client 不能申请 generative-language scope)
+#    - Requires: Create OAuth 2.0 Client in GCP Console + OAuth consent screen
 #    - Setup Guide: https://ai.google.dev/gemini-api/docs/oauth
+#    - ⚠️ IMPORTANT: OAuth Client 必须发布为正式版本 (Production)
+#      Testing 模式限制: 只能添加 100 个测试用户, refresh token 7 天后过期
+#      发布步骤: GCP Console → OAuth consent screen → PUBLISH APP
 #
 # Configuration:
-# Use Gemini CLI's public OAuth credentials (same as official Google Gemini CLI tool):
-GEMINI_OAUTH_CLIENT_ID=681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com
-GEMINI_OAUTH_CLIENT_SECRET=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
+# Leave empty to use the built-in Gemini CLI OAuth client (Code Assist OAuth only).
+# To enable AI Studio OAuth, set your own OAuth client ID/secret here.
+GEMINI_OAUTH_CLIENT_ID=
+GEMINI_OAUTH_CLIENT_SECRET=
 # Optional; leave empty to auto-select scopes based on oauth_type
 GEMINI_OAUTH_SCOPES=