docs(selfhost): add Claude Code + Codex token setup and rotation guide

[JSONbored]

Summary

• Self-hosters running the AI review engine via the Claude Code (CLAUDE_CODE_OAUTH_TOKEN) or Codex (auth.json) subscription CLIs had no guidance for obtaining, wiring up, or rotating those credentials once a subscription's usage limit resets or a token needs replacing. Adds "Claude Code (subscription)", "Codex (subscription)", and "Recognizing a stale or missing credential" sections to the existing self-host AI providers doc, covering setup and the (very different) rotation procedure for each provider.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Closes #4074

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries — N/A, static docs content with no logic branches

If any required check was skipped, explain why:

• Docs-only change to one apps/gittensory-ui route file — no src/**, .github/workflows/**, or MCP package files touched. npm run test:changed (Vitest's import-graph analysis against origin/main) confirms zero backend test files are affected, and apps/** is explicitly excluded from Codecov (codecov.yml), so there's no coverage obligation. Skipped actionlint (no workflow changes), test:coverage/test:workers (no src//Worker changes), build:mcp/test:mcp-pack (no MCP package changes) as genuinely inapplicable rather than unverified. Also ran (though not on this checklist) npm run docs:drift-check (passes) and the UI's own suite (ui:test, 71/71 passing, unchanged by this diff).

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed — every credential shown is an obviously-fake placeholder (e.g. <token from claude setup-token>), never a real value.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A, no such change.
• API/OpenAPI/MCP behavior is updated and tested where needed. — N/A, no such change.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. — N/A, static prose/code-block content, no data fetching.
• Visible UI changes include a UI Evidence section below with screenshots. — N/A for this owner-authored PR (see UI Evidence below).
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. — this PR is the docs update itself; changelog untouched.

UI Evidence

N/A — owner-authored PR (screenshot-hosting isn't wired up for non-interactive use yet). Verified the rendered page directly against the live dev server instead: all 11 page headings appear in the correct order, the 3 new sections' rendered text matches the source exactly, the "Rotating it needs no restart" callout renders with the correct note variant, and a full-page screenshot confirmed correct end-to-end dark-theme rendering with no layout breakage.

Notes

• Codex's rotation story is the interesting asymmetry this doc didn't cover before: it has no equivalent of claude setup-token — the credential is a mounted auth.json file, re-read fresh on every review, so re-running codex auth takes effect on the very next review with no restart/recreate needed. Claude Code is the opposite: its token is injected via env_file at container-creation time, so rotating it needs docker compose up -d --no-deps gittensory, not a plain restart.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	6d9e9d0	Commit Preview URL Branch Preview URL	Jul 07 2026, 11:59 PM