fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/deploy/deployment-modes.md

@@ -0,0 +1,88 @@
+---
+title: Deployment Modes
+summary: local_trusted vs authenticated (private/public)
+---
+
+Paperclip supports two runtime modes with different security profiles. Reachability is configured separately with `bind`.
+
+## `local_trusted`
+
+The default mode. Optimized for single-operator local use.
+
+- **Host binding**: loopback only (localhost)
+- **Bind**: `loopback`
+- **Authentication**: no login required
+- **Use case**: local development, solo experimentation
+- **Board identity**: auto-created local board user
+
+```sh
+# Set during onboard
+pnpm paperclipai onboard
+# Choose "local_trusted"
+```
+
+## `authenticated`
+
+Login required. Supports two exposure policies.
+
+### `authenticated` + `private`
+
+For private network access (Tailscale, VPN, LAN).
+
+- **Authentication**: login required via Better Auth
+- **URL handling**: auto base URL mode (lower friction)
+- **Host trust**: private-host trust policy required
+- **Bind**: choose `loopback`, `lan`, `tailnet`, or `custom`
+
+```sh
+pnpm paperclipai onboard
+# Choose "authenticated" -> "private"
+```
+
+Allow custom Tailscale hostnames:
+
+```sh
+pnpm paperclipai allowed-hostname my-machine
+```
+
+### `authenticated` + `public`
+
+For internet-facing deployment.
+
+- **Authentication**: login required
+- **URL**: explicit public URL required
+- **Security**: stricter deployment checks in doctor
+- **Bind**: usually `loopback` behind a reverse proxy; `lan/custom` is advanced
+
+```sh
+pnpm paperclipai onboard
+# Choose "authenticated" -> "public"
+```
+
+## Board Claim Flow
+
+When migrating from `local_trusted` to `authenticated`, Paperclip emits a one-time claim URL at startup:
+
+```
+/board-claim/<token>?code=<code>
+```
+
+A signed-in user visits this URL to claim board ownership. This:
+
+- Promotes the current user to instance admin
+- Demotes the auto-created local board admin
+- Ensures active company membership for the claiming user
+
+## Changing Modes
+
+Update the deployment mode:
+
+```sh
+pnpm paperclipai configure --section server
+```
+
+Runtime override via environment variable:
+
+```sh
+PAPERCLIP_DEPLOYMENT_MODE=authenticated PAPERCLIP_BIND=lan pnpm paperclipai run
+```