cli: Gemini CLI support, clear permission errors, Codex hint without the CLI #16

Requested by: Chenchen (@chenchenSimular), 2026-11-04

Rationale: The add-mcp spike (#14, #15) showed Gemini CLI reads a plain mcpServers entry and signs in with OAuth by itself, so box can support it with our existing JSON writer and no new dependency. The same spike found two first-run gaps that don't need add-mcp: when a config can't be written (owned by another user, locked by the app, Windows "Access is denied"), connect shows a raw error; and the Codex sign-in hint says codex mcp login box even when only the Codex app is installed and no codex is on PATH.

What:

1. A gemini-cli client for npx @simular-ai/box connect / doctor / remove, on our json-client.js writer: ~/.gemini/settings.json, mcpServers.box, in the shape Gemini CLI needs for an OAuth streamable-HTTP server, plus a next hint (/mcp auth box).
2. A clear message on EACCES/EPERM. For Codex it should also print the Codex app steps (Settings -> MCP servers -> Add server -> Streamable HTTP -> URL -> Save -> restart -> Authenticate).
3. A Codex sign-in hint that points at the Codex app when codex is not on PATH.
4. A gemini-cli job in the real-client install matrix on Linux, macOS and Windows, plus README updates.

Done when: a PR is merged with unit tests, and the install matrix (including gemini-cli on all 3 OSes) is green.