docs(agy): Code Assist proxy spike findings (#698)

[lis186]

Refs #698. Spike only: findings doc, no production code. Draft, not for merge as-is.

Adds docs/solutions/agy-code-assist-spike.md, which records wire observations for routing the Antigravity CLI (agy 1.4.0, OAuth login) through a proxy via CLOUD_CODE_URL.

Answers to the three questions in #698

1. Plain http + path prefix: both accepted. CLOUD_CODE_URL=http://127.0.0.1:<port>/<prefix> works with no TLS setup. The prefix is preserved on every request (/<prefix>/v1internal:<method>), so the proxy must strip it before forwarding. If it isn't stripped, the upstream returns 404 and agy fails closed after retrying loadCodeAssist.
2. Discovery / onboarding / quota: all pass through with 200: loadCodeAssist, fetchUserInfo, fetchAdminControls, fetchAvailableModels, retrieveUserQuotaSummary, listExperiments, plus trajectory ACL/analytics calls. Only streamGenerateContent?alt=sse is conversation traffic.
3. usageMetadata: at response.usageMetadata in every SSE data: chunk. The counts are cumulative, so the last chunk is final. Fields seen: promptTokenCount, candidatesTokenCount, thoughtsTokenCount, totalTokenCount (total = prompt + candidates + thoughts). cachedContentTokenCount was not observed, so cache handling is still unverified.

Extra finding (affects the design)

agy 1.4.0 uses daily-cloudcode-pa.googleapis.com by default, not cloudcode-pa. When the proxy forwarded to cloudcode-pa, generation calls got 429 RESOURCE_EXHAUSTED even though discovery calls succeeded. The upstream host should therefore be overridable rather than hardcoded.

Safety

• A throwaway proxy outside the repo logged only paths, header names, JSON key paths and usage numbers. No prompts, tokens or account/project ids were logged.
• The env var was set per command only. agy config, login and settings were not modified.
• After the spike, a plain agy models call with no override succeeded, and the OAuth token fingerprint matched the pre-spike baseline.

Not yet verified

Cached-token field, subagent identification via labels, sessionId stability across turns, interactive mode and API-key mode.