docs(selfhost): guide for setting up, using, and rotating Claude Code / Codex tokens

[JSONbored]

Problem

Self-hosters running the AI review engine via the Claude Code (CLAUDE_CODE_OAUTH_TOKEN) or Codex (auth.json + GITTENSORY_ENABLE_UNSAFE_CODEX_REVIEWER) subscription CLIs have no dedicated guide for obtaining, wiring up, and — critically — rotating these credentials once a subscription's usage limit resets or a token needs regenerating. .env.selfhost.example already points to /docs/self-hosting-ai-providers "for the full reference," but that page has no rotation guidance, so an operator whose token runs out mid-operation has nowhere to look.

Area

Documentation

Proposal

Add self-host docs (in apps/gittensory-ui) covering, for both providers:

• Obtaining CLAUDE_CODE_OAUTH_TOKEN via claude setup-token, and Codex's auth.json + the GITTENSORY_ENABLE_UNSAFE_CODEX_REVIEWER opt-in and its security tradeoff (read-only sandbox notwithstanding, the OAuth home is on the same filesystem as a prompt-influenced review).
• Safe storage: .env (gitignored), restrictive file permissions, never committed.
• The rotation procedure: regenerate the credential, update .env, then recreate (not just restart) the container that reads it, since env_file values are baked in at container-creation time.
• Recognizing a stale/expired credential in self-host logs (claude_code_error_401, codex_no_auth, claude_code_no_oauth_token) versus other AI-provider failure modes.

Acceptance criteria

• New content lives under apps/gittensory-ui/** (in wantedPaths), reachable from the docs navigation.
• Covers setup + rotation for BOTH providers, not just one.
• Every token example is an obviously-fake placeholder — never a real-looking secret.
• Cross-linked from the existing self-host AI-provider docs referenced by .env.selfhost.example.

Test scenarios

Doc-only change under apps/gittensory-ui — not measured by Codecov (apps/** is excluded). Coverage here is ui:lint / ui:typecheck / ui:test / ui:build passing and docs:drift-check staying clean; no new runtime branches to unit-test.

Boundaries

• This does not restore GitHub Pages, VitePress, site/, or CNAME.
• This does not require storing user PATs or adding a non-GitHub identity provider.
• This does not expose wallet details, raw trust scores, private rankings, or reward estimates publicly.
• This does not auto-close, auto-merge, rewrite contributor work, or label PRs outside the confirmed-miner policy.
• Public GitHub output will be tested against forbidden language (wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, public score estimate).

[linear-code]

JSO-3140