fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/deploy/storage.md

@@ -0,0 +1,39 @@
+---
+title: Storage
+summary: Local disk vs S3-compatible storage
+---
+
+Paperclip stores uploaded files (issue attachments, images) using a configurable storage provider.
+
+## Local Disk (Default)
+
+Files are stored at:
+
+```
+~/.paperclip/instances/default/data/storage
+```
+
+No configuration required. Suitable for local development and single-machine deployments.
+
+## S3-Compatible Storage
+
+For production or multi-node deployments, use S3-compatible object storage (AWS S3, MinIO, Cloudflare R2, etc.).
+
+Configure via CLI:
+
+```sh
+pnpm paperclipai configure --section storage
+```
+
+## Configuration
+
+| Provider | Best For |
+|----------|----------|
+| `local_disk` | Local development, single-machine deployments |
+| `s3` | Production, multi-node, cloud deployments |
+
+Storage configuration is stored in the instance config file:
+
+```
+~/.paperclip/instances/default/config.json
+```