Cache Gemini CLI metadata for sandboxed refresh

[cbusillo]

Summary

• Add a Gemini CLI metadata cache keyed separately from the OAuth credentials file.
• Let Settings cache Gemini CLI OAuth client metadata from a user-selected Gemini CLI bundle folder or JS file.
• Use cached metadata in the sandboxed app and refresh-agent connector path before attempting filesystem discovery.
• Add tests for user-selected metadata parsing and sandbox cached metadata wiring.

Root Cause

The TestFlight app was on the expected build and Gemini was installed at the normal Homebrew path, but the app sandbox only had user-selected access to the Gemini OAuth credentials JSON. Gemini's OAuth client metadata lives in the CLI package bundle under Homebrew, so background refresh could not discover it without an explicit user-selected path or cached metadata.

Validation

• Targeted Gemini/account/provider tests passed.
• Full commit gate passed.
• Whitespace diff check passed.
• Canonical runtime baseline install and launch passed.