fix: resolve gemini api key duplication and improve error classification

[nethi]

Summary

This PR fixes a bug where the Gemini API key was being duplicated during paste on the setup page and improves error detection for invalid Gemini API keys during task execution.

Changes

• Setup Page: Added e.preventDefault() to the Gemini key onPaste handler in apps/web/src/app/setup/page.tsx to prevent the browser's default paste action from interfering with React state updates.
• Gemini Adapter: Updated GeminiAdapter in packages/agent-adapters/src/gemini.ts to scan log output for "API key not valid" and "API_KEY_INVALID" patterns.
• Error Classifier: Added a specific rule to packages/shared/src/error-classifier.ts to catch invalid API key errors and provide actionable remedies.

Test Validation

• Manually verified that pasting the Gemini API key on the setup page no longer results in a duplicated string.
• Verified that the agent now correctly identifies and reports "Invalid API key" when the Gemini CLI exits with a 400 error due to a bad key, instead of a generic "exit code 1".

[jonwiggins]

Most of this looks great — the paste handler fix at apps/web/src/app/setup/page.tsx:1740 mirrors the existing GitHub/GitLab pattern cleanly, and the API-key error classifier addition is well-placed.

One thing to address before merge: at packages/agent-adapters/src/gemini.ts:67-68, you add GEMINI_CLI_TRUST_WORKSPACE: "true" to the env. This isn't mentioned in the PR description, doesn't have precedent elsewhere in the codebase, and as far as I can tell isn't a documented Gemini CLI environment variable — workspace trust in gemini-cli is normally configured via settings.json (security.folderTrust), which this adapter already writes at lines 106-115.

Could you either:

• remove the env-var line if it's vestigial, or
• replace it with the equivalent settings.json field if there's a real workspace-trust issue you're working around, or
• expand the PR description to explain what failure mode it fixes

Also a small ask (not blocking): a one-liner regression test in error-classifier.test.ts for the new API key not valid pattern would be nice — there's a clear template you can copy from the existing OpenAI quota / OAuth expired tests.