Implement durable OAuth MCP bridge with local Codex worker and deployment guides

.env.example

@@ -0,0 +1,26 @@
+# Runtime secrets: replace all placeholders. This file cannot start production unchanged.
+BRIDGE_MODE=production
+BRIDGE_PUBLIC_URL=https://bridge.example.com
+BRIDGE_PUBLIC_HOST=bridge.example.com
+BRIDGE_SERVER_URL=https://bridge.example.com
+BRIDGE_WORKER_TOKEN=GENERATE_AT_LEAST_32_RANDOM_CHARACTERS
+BRIDGE_WORKER_ID=home
+BRIDGE_WORKSPACES=demo
+BRIDGE_DATABASE=/data/server.sqlite
+BRIDGE_RETENTION_DAYS=30
+BRIDGE_OAUTH_ISSUER=https://identity.example.com/realms/codex-bridge
+BRIDGE_OAUTH_JWKS_URL=https://identity.example.com/realms/codex-bridge/protocol/openid-connect/certs
+BRIDGE_OAUTH_AUDIENCE=https://bridge.example.com
+BRIDGE_OWNER_SUBJECT=REPLACE_WITH_OWNER_SUBJECT_UUID
+# Compose settings: inspect the existing reverse proxy before setting these.
+BRIDGE_PROXY_NETWORK=REPLACE_WITH_EXISTING_NETWORK
+BRIDGE_PROXY_ENTRYPOINT=websecure
+BRIDGE_TLS_RESOLVER=REPLACE_WITH_EXISTING_RESOLVER
+BRIDGE_PYTHON_IMAGE=REPLACE_WITH_VERIFIED_PYTHON_IMAGE_DIGEST
+# Worker only: canonical absolute local paths; never a path supplied through MCP.
+BRIDGE_WORKSPACE_MAP='{"demo":"/absolute/path/to/repository/demo"}'
+BRIDGE_WORKER_STATE=/absolute/path/to/private/worker.sqlite
+BRIDGE_CODEX_BIN=codex
+BRIDGE_CODEX_MODEL=gpt-6.1-sol
+BRIDGE_SANDBOX=workspace-write
+BRIDGE_POLL_SECONDS=2