[firebase_ai] Live sessions on web don't send the App Check token #18938

Bug

On web, a LiveGenerativeModel session doesn't send the App Check token, so when App Check is enforced for Firebase AI Logic the server closes every Live session right after it connects:

WebSocket Closed, closeCode: 1008, closeReason: Firebase App Check token is invalid.

Non-Live requests in the same app pass App Check with the same token.

Cause

LiveSession._defaultConnector in lib/src/live_session.dart drops the headers on web:

static WebSocketChannel _defaultConnector(
        Uri uri, Map<String, String> headers) =>
    kIsWeb
        ? WebSocketChannel.connect(uri)
        : IOWebSocketChannel.connect(uri, headers: headers);

live_model.dart builds those headers with BaseModel.firebaseTokens(...), so the X-Firebase-AppCheck header (and the Auth token) only reach the server on native platforms. On web the token is in neither the URL (only ?key=) nor the setup message. Browsers can't set headers on a WebSocket, so the token needs to travel another way, for example as a query parameter or in the setup message, if the backend accepts one.

Same code in firebase_ai 3.15.0, 4.0.0, 5.0.0 and 5.1.0.

Repro

1. Enforce App Check for Firebase AI Logic and register a web debug token.
2. On Chrome, connect a Live session, for example FirebaseAI.googleAI().liveGenerativeModel(model: 'gemini-3.8-live') and connect().
3. The server closes the socket with 1008 "Firebase App Check token is invalid".

Seen with the Gemini Developer API and with Agent Platform (us-central1). Found through the Genkit Firebase AI plugin: genkit-ai/genkit-dart#730.

Versions

firebase_ai 5.1.0, Flutter 3.47.9, Chrome.