v2.4.1 — wire server.js + slash commands to proxy login

Bugfix release. v2.4.0 shipped a clean proxy-based lib/oauth-login.js but left server.js and the four slash-command .toml prompts wired to the v2.3 PKCE loopback contract. /google-ads:login didn't complete cleanly and the model was given stale guidance.

Fixed

• remote_login — drops the GADS_CLI_OAUTH_CLIENT_ID / GOOGLE_ADS_CLIENT_ID guard; persists only the opaque session; prints storage backend on success.
• remote_switch — reuses the stored opaque sessionId directly (valid 90 days server-side). Legacy refresh-token minting only fires for v2.3 identities that still carry one.
• remote_logout — invalidates the opaque session at googleadsagent.ai via POST /api/auth { action: "logout" }. Legacy Google revocation still attempted for v2.3 identities.
• All four .toml command prompts rewritten for the v2.4 proxy flow (no Cloud Console, no client IDs, no refresh tokens in the CLI).
• McpServer version string fixed (was still 2.3.0).
• gemini-extension.json marks GADS_SITE_SESSION_ID as legacy optional fallback.
• README "Safety" section updated: hosted OAuth + opaque session.

Backwards compatibility

Fully backward compatible. v2.3 identities with refresh tokens in the keychain continue to work; they upgrade to the slimmer session-only shape on next /google-ads:login.

Tests

11/11 pass (oauth-login.proxy + session-store suites).

Upgrade

git -C ~/.gemini/extensions/google-ads-agent pull (or reinstall the extension per your usual workflow) and relaunch the Gemini CLI.