### Environment * Firebase Component: AI Logic (`firebase-ai`) * Component version: 17.11.0 (via firebase-bom 34.12.0); also present on `main` as of today. ### Problem When App Check is enforced on `firebasevertexai.googleapis.com`, Gemini Live sessions fail with: ``` ServiceConnectionHandshakeFailedException: Channel was closed by the server. Details: Firebase App Check token is invalid. ``` HTTPS methods on the same `FirebaseAI` instance (`generateContent`, `generateContentStream`, `countTokens`) succeed with identical App Check setup. Only the Live API path (`liveModel().connect()`) fails. Looking at [`APIController.kt:258-259`](https://github.com/firebase/firebase-android-sdk/blob/main/ai-logic/firebase-ai/src/main/kotlin/com/google/firebase/ai/common/APIController.kt#L258-L259): ```kotlin suspend fun getWebSocketSession(location: String): DefaultClientWebSocketSession = client.webSocketSession(getBidiEndpoint(location)) { applyCommonHeaders() } ``` The WebSocket config lambda calls only `applyCommonHeaders()`. It does not call `applyHeaderProvider()`, which is what sets the `X-Firebase-AppCheck` header (via `AppCheckHeaderProvider.generateHeaders()`). Other methods like `countTokens` (line 273) correctly call both. Result: WebSocket upgrade request is sent without an App Check token, so the server rejects it. ### Steps to reproduce 1. Enable App Check enforcement on `firebasevertexai.googleapis.com`. 2. Install a provider factory at startup: ```kotlin Firebase.appCheck.installAppCheckProviderFactory(PlayIntegrityAppCheckProviderFactory.getInstance()) ``` 3. Call Live API: ```kotlin FirebaseAI.getInstance( backend = GenerativeBackend.vertexAI("us-central1"), useLimitedUseAppCheckTokens = true ).liveModel("gemini-live-2.5-flash-native-audio").connect() ``` 4. Observe `ServiceConnectionHandshakeFailedException: ... App Check token is invalid.` 5. Confirm `generativeModel(...).generateContentStream(...)` works on the same setup.