fix(security): do not bind-mount host CLI auth dirs by default (#3521)

* fix(security): do not bind-mount host CLI auth dirs by default

The Compose stack bind-mounted the entire ~/.claude and ~/.codex dirs
(read-only) into the root gateway container in every configuration -- exposing
not just credentials but full conversation history, per-project session data,
and global CLI config. The default OpenAI-compatible model providers and the
local sandbox never use them.

Move the mounts to an opt-in docker/docker-compose.cli-auth.yaml overlay.
Document env-token paths (CLAUDE_CODE_OAUTH_TOKEN, CODEX_AUTH_PATH) in
.env.example -- the Gateway credential loader reads env first, so most setups
need no mount at all. Document the exposure and per-mode options in SECURITY.md.

Reported by @greatmengqi.

* docs: clarify ACP adapter auth and add Claude single-file credential option

- ACP adapters authenticate independently (many take an env API key like
  ANTHROPIC_API_KEY and need no mount); the cli-auth overlay is only for
  adapters that read the full CLI config dir. Avoids steering users toward
  mounting the whole dir for ACP when env auth usually suffices.
- Add CLAUDE_CODE_CREDENTIALS_PATH (single .credentials.json) as a Claude
  one-file option, matching codex CODEX_AUTH_PATH and the README.

* docs: cite claude-code-acp env auth and CLAUDE_CONFIG_DIR in ACP guidance

Replace the generic 'some adapters' wording with the verified behavior of
the common claude-code-acp adapter (env ANTHROPIC_API_KEY startup + CLAUDE_CONFIG_DIR),
so the 'no ~/.claude mount needed for ACP' guidance is backed by a concrete adapter.

docker/docker-compose.cli-auth.yaml

@@ -0,0 +1,36 @@
+# DeerFlow — CLI auth overlay (OPT-IN, NOT loaded by default)
+#
+# Bind-mounts the host Claude Code / Codex CLI config dirs into the gateway so:
+#   - ClaudeChatModel / Codex model providers can reuse the CLI subscription
+#     login (~/.claude/.credentials.json, ~/.codex/auth.json), and
+#   - ACP agents (acp_agents in config.yaml) that run the claude/codex CLI
+#     inside the container can read their config.
+#
+# SECURITY: these mounts expose the ENTIRE ~/.claude and ~/.codex dirs
+# (conversation history, projects, global config, long-lived credentials) into
+# the gateway container, read-only. A gateway compromise leaks all of it. That
+# is why they are NOT mounted by default.
+#
+# Prefer passing only a token via env instead (no directory exposure):
+#   CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_AUTH_TOKEN for Claude, CODEX_AUTH_PATH
+#   for a single Codex auth file — see .env.example and SECURITY.md.
+# Use this overlay only when you need the full CLI config (e.g. ACP adapters
+# that run the CLI in-container and read more than just the credential file).
+#
+# Manual use (works with both prod and dev compose):
+#   docker compose -f docker-compose.yaml -f docker-compose.cli-auth.yaml up -d
+services:
+  gateway:
+    volumes:
+      - type: bind
+        source: ${HOME:?HOME must be set}/.claude
+        target: /root/.claude
+        read_only: true
+        bind:
+          create_host_path: true
+      - type: bind
+        source: ${HOME:?HOME must be set}/.codex
+        target: /root/.codex
+        read_only: true
+        bind:
+          create_host_path: true