feat: add Gemini auth check to token warning banner

/auth/status now returns per-backend status: Claude warns on <24h expiry,
Gemini warns only when oauth_creds.json is missing or has no refresh_token
(access token rotates automatically so expiry_date is not a useful signal).
Banner shows warnings for both backends when needed, and the hint text
names the specific CLI commands to run.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/static/app.js

@@ -967,6 +967,7 @@
         // ── Auth token warning banner ─────────────────────────────
         const authBanner      = document.getElementById('auth-banner');
         const authBannerMsg   = document.getElementById('auth-banner-msg');
+        const authBannerHint  = document.getElementById('auth-banner-hint');
         const authBannerClose = document.getElementById('auth-banner-close');
 
         async function checkAuthStatus() {
@@ -974,13 +975,36 @@
                 const res = await fetch('/auth/status');
                 if (!res.ok) return;
                 const d = await res.json();
-                if (!d.warning) return;
 
-                const msg = d.expired
-                    ? '✕ Claude CLI token has expired'
-                    : `⚠ Claude CLI token expires in ${d.hours_remaining}h`;
-                authBannerMsg.textContent = msg;
-                authBanner.classList.toggle('expired', !!d.expired);
+                const warnings = [];
+                const fixes    = [];
+                let anyExpired = false;
+
+                if (d.claude?.warning) {
+                    if (d.claude.expired) {
+                        warnings.push('✕ Claude CLI token has expired');
+                        anyExpired = true;
+                    } else {
+                        warnings.push(`⚠ Claude CLI token expires in ${d.claude.hours_remaining}h`);
+                    }
+                    fixes.push('<code>claude</code>');
+                }
+
+                if (d.gemini?.warning) {
+                    warnings.push('⚠ Gemini CLI not authenticated');
+                    fixes.push('<code>gemini</code>');
+                }
+
+                if (!warnings.length) {
+                    authBanner.classList.remove('show');
+                    return;
+                }
+
+                authBannerMsg.innerHTML = warnings.join('<br>');
+                authBannerHint.innerHTML =
+                    `To fix: SSH into the Cortex host and run ${fixes.join(' and/or ')} — `
+                    + 'follow the login prompt, then restart Cortex.';
+                authBanner.classList.toggle('expired', anyExpired);
                 authBanner.classList.add('show');
             } catch { /* silently ignore — don't break the UI */ }
         }