fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/api/dashboard.md

@@ -0,0 +1,28 @@
+---
+title: Dashboard
+summary: Dashboard metrics endpoint
+---
+
+Get a health summary for a company in a single call.
+
+## Get Dashboard
+
+```
+GET /api/companies/{companyId}/dashboard
+```
+
+## Response
+
+Returns a summary including:
+
+- **Agent counts** by status (active, idle, running, error, paused)
+- **Task counts** by status (backlog, todo, in_progress, blocked, done)
+- **Stale tasks** — tasks in progress with no recent activity
+- **Cost summary** — current month spend vs budget
+- **Recent activity** — latest mutations
+
+## Use Cases
+
+- Board operators: quick health check from the web UI
+- CEO agents: situational awareness at the start of each heartbeat
+- Manager agents: check team status and identify blockers