fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/deploy/local-development.md

@@ -0,0 +1,105 @@
+---
+title: Local Development
+summary: Set up Paperclip for local development
+---
+
+Run Paperclip locally with zero external dependencies.
+
+## Prerequisites
+
+- Node.js 20+
+- pnpm 9+
+
+## Start Dev Server
+
+```sh
+pnpm install
+pnpm dev
+```
+
+This starts:
+
+- **API server** at `http://localhost:3100`
+- **UI** served by the API server in dev middleware mode (same origin)
+
+No Docker or external database required. Paperclip uses embedded PostgreSQL automatically.
+
+## One-Command Bootstrap
+
+For a first-time install:
+
+```sh
+pnpm paperclipai run
+```
+
+This does:
+
+1. Auto-onboards if config is missing
+2. Runs `paperclipai doctor` with repair enabled
+3. Starts the server when checks pass
+
+## Bind Presets In Dev
+
+Default `pnpm dev` stays in `local_trusted` with loopback-only binding.
+
+To open Paperclip to a private network with login enabled:
+
+```sh
+pnpm dev --bind lan
+```
+
+For Tailscale-only binding on a detected tailnet address:
+
+```sh
+pnpm dev --bind tailnet
+```
+
+Legacy aliases still work and map to the older broad private-network behavior:
+
+```sh
+pnpm dev --tailscale-auth
+pnpm dev --authenticated-private
+```
+
+Allow additional private hostnames:
+
+```sh
+pnpm paperclipai allowed-hostname dotta-macbook-pro
+```
+
+For full setup and troubleshooting, see [Tailscale Private Access](/deploy/tailscale-private-access).
+
+## Health Checks
+
+```sh
+curl http://localhost:3100/api/health
+# -> {"status":"ok"}
+
+curl http://localhost:3100/api/companies
+# -> []
+```
+
+## Reset Dev Data
+
+To wipe local data and start fresh:
+
+```sh
+rm -rf ~/.paperclip/instances/default/db
+pnpm dev
+```
+
+## Data Locations
+
+| Data | Path |
+|------|------|
+| Config | `~/.paperclip/instances/default/config.json` |
+| Database | `~/.paperclip/instances/default/db` |
+| Storage | `~/.paperclip/instances/default/data/storage` |
+| Secrets key | `~/.paperclip/instances/default/secrets/master.key` |
+| Logs | `~/.paperclip/instances/default/logs` |
+
+Override with environment variables:
+
+```sh
+PAPERCLIP_HOME=/custom/path PAPERCLIP_INSTANCE_ID=dev pnpm paperclipai run
+```