feat: implement headless LS authentication via state sync

Reverse-engineered the UnifiedStateSyncUpdate protocol:
- initial_state field is bytes (not string), contains serialized Topic proto
- Map key for OAuth is 'oauthTokenInfoSentinelKey'
- Row.value is base64-encoded OAuthTokenInfo protobuf
- OAuthTokenInfo includes access_token, token_type, expiry (Timestamp)
- Set far-future expiry (2099) to prevent token expiry errors

Also fixed:
- PushUnifiedStateSyncUpdate returns proper empty proto response
- Stream keep-alive avoids sending empty envelopes (LS rejects nil updates)
- uss-enterprisePreferences topic handled (empty initial state)

GEMINI.md

@@ -5,10 +5,11 @@ OpenAI-compatible proxy that intercepts and relays requests to Google's Antigrav
 ## Quick Start
 
 ```bash
-# First-time setup (creates user + iptables for MITM)
-sudo ./scripts/mitm-redirect.sh install
+# Headless mode (no running Antigravity app needed)
+RUST_LOG=info ./target/release/antigravity-proxy --headless
 
-# Start as daemon (builds if needed)
+# Classic mode (requires running Antigravity + sudo setup for MITM)
+sudo ./scripts/mitm-redirect.sh install
 proxyctl start
 
 # Or run directly
@@ -204,7 +205,18 @@ Falls back to hardcoded values if the app isn't installed. No manual updates nee
 
 ## Standalone LS
 
-By default, the proxy spawns its own Language Server instance for full isolation:
+By default, the proxy spawns its own Language Server instance for full isolation.
+
+### Headless Mode (`--headless`)
+
+Fully independent — no running Antigravity app, no sudo, no iptables:
+
+1. Generates its own CSRF token (random UUID)
+2. Passes `-standalone=true` and `-extension_server_port=0` to the LS binary
+3. Uses `HTTPS_PROXY` for MITM (no iptables required)
+4. Only needs the LS binary installed at the standard path
+
+### Classic Mode (default)
 
 1. Discovers the main LS config (`extension_server_port`, `csrf_token`) from the running Antigravity app
 2. Spawns a standalone LS binary on a random port
@@ -270,6 +282,7 @@ sudo ./scripts/mitm-redirect.sh uninstall
 
 ### CLI Flags
 
+- `--headless`: Fully standalone — no running Antigravity app required
 - `--no-mitm`: Disable MITM proxy entirely
 - `--no-standalone`: Attach to existing LS instead of spawning standalone
 - `--mitm-port <PORT>`: Override MITM proxy port (default: auto-assign)