fix: support Gemini CLI native auth/model routing and ls_core 1.21.x startup flags

[xiaoqi419]

Summary

This PR fixes several compatibility issues that prevented Gemini CLI from working reliably against the local native proxy path.

What changed

• support x-goog-api-key in request auth extraction for Gemini native requests
• preserve the actual Gemini model from the URL path instead of hardcoding gemini-native
• normalize Gemini SDK method-style paths such as gemini-3-flash-agent:streamGenerateContent
• update native ls_core startup flags for newer binaries (-https_server_port and -extension_server_csrf_token)

Why

Before this patch, Gemini CLI traffic could fail in multiple places:

• requests sent by Gemini CLI used x-goog-api-key, which the server did not accept
• Gemini native routing discarded the real model name, so account quota routing failed
• newer synced ls_core binaries rejected the old -server_port flag and exited immediately on startup

Validation

Validated locally in WSL with the synced ls_core 1.21.6 binary and an imported Antigravity account:

• curl http://127.0.0.1:5173/health returns {"status":"ok"}
• direct Gemini native request to /v1beta/models/gemini-3-flash-agent:streamGenerateContent returns OK
• gemini -p '只回复 OK' --output-format json returns a successful JSON response through the local proxy

Notes

There is still a non-blocking warning in logs around one reactive stream path missing a CSRF token, but it does not block basic Gemini CLI requests after these fixes.