feat(voice): harden Gemini Live provider integration

.env.example

@@ -56,6 +56,18 @@ GOOGLE_MAPS_SERVER_API_KEY=
 # CLIENT-EXPOSED — use a public assets:read token with URL restrictions.
 CESIUM_ION_TOKEN=
 
+# Optional: Gemini Developer API Live voice. Use a separate Gemini API key
+# created in Google AI Studio:
+# https://aistudio.google.com/apikey — separate from the Google Maps keys above.
+# Setup and security: https://ai.google.dev/gemini-api/docs/api-key
+# Free-tier access depends on the model, project eligibility and available quota.
+# SERVER-SIDE ONLY: the browser receives a short-lived session token, not this key.
+GEMINI_API_KEY=
+GEMINI_LIVE_MODEL=gemini-3.8-live
+# Per-IP Gemini session-token throttle; default 30 per minute, 0 disables it.
+# This limits token requests, not provider billing or audio-session duration.
+# GEV_RATELIMIT_GEMINI_PER_MIN=30
+
 # Optional: OpenAI Realtime voice control. API key is the default cloud auth.
 # Provider Settings can instead opt voice into the signed-in local
 # ChatGPT/Codex OAuth session; the browser still receives only a short-lived