Implement durable OAuth MCP bridge with local Codex worker and deployment guides

deploy/nginx-location.conf.example

@@ -0,0 +1,12 @@
+# Optional alternative for an existing Nginx proxy. Inspect existing config first.
+# Inside an existing TLS vhost whose server_name comes from deployment configuration:
+location / {
+    proxy_pass http://codex-bridge:8000;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_http_version 1.1;
+    proxy_buffering off;
+    proxy_read_timeout 90s;
+}
+# The app ignores forwarded headers entirely; it uses BRIDGE_PUBLIC_URL for metadata.