fix(providers): detect expired gemini-web sessions and add testConnection (#9407)

src/lib/providers/validation/webProvidersB.ts

@@ -248,11 +248,34 @@ export async function validateGeminiWebProvider({ apiKey, providerSpecificData =
     // session looks like here, so treat it as success. A redirect to a private/internal
     // host is a genuine SSRF signal and must stay invalid — isSecurityBlockError()
     // already makes that distinction.
+    //
+    // #9407: EXPIRED gemini sessions redirect to accounts.google.com/ServiceLogin,
+    // which is a PUBLIC redirect (not SSRF) but represents a dead session. Inspect
+    // the redirect target to distinguish between:
+    //   - accounts.google.com/ServiceLogin — expired session → valid:false
+    //   - other accounts.google.com paths — ambiguous, warn but treat as valid
+    //   - non-Google redirects (e.g. gemini.google.com redirect loop) — valid
     if (
       error instanceof SafeOutboundFetchError &&
       error.code === "REDIRECT_BLOCKED" &&
       !isSecurityBlockError(error)
     ) {
+      const location = error.location ?? "";
+      if (/accounts\.google\.com\/.*ServiceLogin/i.test(location)) {
+        return {
+          valid: false,
+          error:
+            "Session expired — re-paste __Secure-1PSID from gemini.google.com DevTools → Cookies",
+        };
+      }
+      if (/accounts\.google\.com/i.test(location)) {
+        return {
+          valid: true,
+          error: null,
+          warning:
+            "Cookie accepted. Full verification requires browser test on first chat.",
+        };
+      }
       return { valid: true, error: null };
     }
     return toValidationErrorResult(error);