refactor(open-sse): dedupe Google OAuth client credentials (#4)

clientId/clientSecret của antigravity + gemini bị lặp 3 nơi
(registry, usage.js, src/lib/oauth). Gom vào shared.js
(ANTIGRAVITY_OAUTH_CLIENT, GOOGLE_OAUTH_CLIENT), các file spread vào.
Byte-for-byte: PROVIDERS/alias/oauth-url equal, golden 142 pass.
Thêm test guard nội dung + alias resolution.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/unit/antigravity-oauth-client.test.js

@@ -0,0 +1,49 @@
+// Guards the deduped Antigravity OAuth client: same values across all 3 sources after refactor.
+import { describe, it, expect } from "vitest";
+
+const EXPECTED = {
+  clientId: "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com",
+  clientSecret: "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",
+};
+const GOOGLE = {
+  clientId: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
+  clientSecret: "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",
+};
+
+describe("antigravity oauth client (deduped)", () => {
+  it("shared source holds the canonical credentials", async () => {
+    const { ANTIGRAVITY_OAUTH_CLIENT } = await import("../../open-sse/providers/shared.js");
+    expect(ANTIGRAVITY_OAUTH_CLIENT).toEqual(EXPECTED);
+  });
+
+  it("registry transport keeps clientId/clientSecret", async () => {
+    const ag = (await import("../../open-sse/providers/registry/antigravity.js")).default;
+    expect(ag.transport.clientId).toBe(EXPECTED.clientId);
+    expect(ag.transport.clientSecret).toBe(EXPECTED.clientSecret);
+  });
+
+  it("google client shared by gemini + gemini-cli", async () => {
+    const { GOOGLE_OAUTH_CLIENT } = await import("../../open-sse/providers/shared.js");
+    expect(GOOGLE_OAUTH_CLIENT).toEqual(GOOGLE);
+    const gemini = (await import("../../open-sse/providers/registry/gemini.js")).default;
+    const gc = (await import("../../open-sse/providers/registry/gemini-cli.js")).default;
+    expect(gemini.transport.clientSecret).toBe(GOOGLE.clientSecret);
+    expect(gc.transport.clientSecret).toBe(GOOGLE.clientSecret);
+  });
+
+  // Vitest can't resolve the `@/` alias used inside oauth.js (pre-existing infra gap),
+  // so guard the refactor textually: it must spread the shared client + keep other fields.
+  it("src oauth.js imports shared client + keeps full shape", async () => {
+    const { readFileSync } = await import("node:fs");
+    const { fileURLToPath } = await import("node:url");
+    const { dirname, join } = await import("node:path");
+    const here = dirname(fileURLToPath(import.meta.url));
+    const src = readFileSync(join(here, "../../src/lib/oauth/constants/oauth.js"), "utf8");
+    expect(src).toContain('import { ANTIGRAVITY_OAUTH_CLIENT, GOOGLE_OAUTH_CLIENT } from "open-sse/providers/shared.js"');
+    expect(src).toContain("...ANTIGRAVITY_OAUTH_CLIENT");
+    expect(src).toContain("...GOOGLE_OAUTH_CLIENT");
+    expect(src).toContain('authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth"');
+    expect(src).not.toContain(EXPECTED.clientSecret); // antigravity secret no longer hardcoded here
+    expect(src).not.toContain(GOOGLE.clientSecret);   // gemini secret no longer hardcoded here
+  });
+});