feat(provider): add chatgpt provider with ChatGPT account sign-in

[Sayt-0]

Summary

Adds a chatgpt model provider that uses a ChatGPT Plus/Pro/Business subscription instead of an OPENAI_API_KEY, via the same OAuth PKCE flow as OpenAI's Codex CLI. docker agent auth login chatgpt stores the credential; the access token is refreshed transparently and surfaces through the standard credential machinery (doctor, setup, auto selection, first_available).

How it works

docker agent auth login chatgpt
        |  (browser, OAuth PKCE, auth.openai.com, localhost:1455 callback)
        v
<config-dir>/chatgpt-auth.json  (0600, auto-refresh)
        |
        v
"chatgpt-login" env source  ->  virtual CHATGPT_OAUTH_TOKEN variable
        |
        +-> doctor / setup / auto selection / first_available / preflight (generic)
        +-> chatgpt provider (OpenAI client + per-request middleware:
            Authorization, chatgpt-account-id, OpenAI-Beta, originator, session_id)

Serving the login as a virtual env var lets every env-var-driven consumer work without special cases, while an explicitly set CHATGPT_OAUTH_TOKEN (e.g. a pre-minted token in CI) keeps precedence over the stored sign-in.

Changes

Area	Change
pkg/chatgpt (new)	PKCE login flow, credential store, token refresh, JWT claims parsing
docker agent auth (new)	login / logout / status [--json], shell completion, telemetry
chatgpt provider	OpenAI-compatible alias; Responses API pinned (the backend has no chat-completions endpoint)
doctor	chatgpt credential row (source chatgpt-login) and a sign-in hint in issues
setup	picking chatgpt runs the browser sign-in instead of asking for an API key
auto selection	chatgpt ordered right after openai, so behavior is unchanged for existing API-key users; default model gpt-5.2
missing-env errors	sign-in hint when CHATGPT_OAUTH_TOKEN is missing
security	token excluded from eval-container credential forwarding; the store is never touched under go test without an explicit override
docs + example	provider page, overview/concepts/configuration tables, JSON schema, examples/chatgpt.yaml

Request shape (Codex backend)

Backend constraint	Handling
Responses API only	chat-completions requests are routed to /responses; an explicit api_type override is ignored (debug-logged)
store must be false	forced
instructions required	system messages are concatenated into the field, with a default fallback
sampling params rejected	temperature, top_p, max_output_tokens dropped (debug-logged)
workspace account header	chatgpt-account-id parsed from the JWT claims

Validation

Check	Result
go build ./... and js/wasm build of touched packages	pass
go test ./...	pass (4 pre-existing environmental failures, identical on a clean tree)
golangci-lint run, go run ./lint ., go mod tidy --diff	clean
docs markdownlint + canonical check	pass

37 new tests cover the OAuth mechanics (fake issuer: PKCE parameters, state validation, code exchange, refresh and token rotation), request shaping (fake Codex backend: endpoint, headers, instructions extraction, multi-turn tool calls), doctor/setup/auto integration, and the auth commands.

Notes

• The localhost callback port (1455) and the client ID are fixed by OpenAI's OAuth client registration for Codex CLI; the flow cannot use a random port.
• Live verification against the real backend needs a ChatGPT account and a browser. The request contract mirrors Codex CLI and known-working open-source integrations; backend errors surface with the full response body (the error-body middleware applies), so any live-contract adjustment stays localized to pkg/model/provider/openai/chatgpt.go.
• Embeddings and reranking are not served by the Codex backend (documented on the provider page).