feat(auth): support subscription login alongside API key

Make ANTHROPIC_API_KEY optional. Add CLAUDE_CODE_OAUTH_TOKEN pass-through
for headless token-based auth (claude setup-token). When neither is set,
Claude Code falls back to browser OAuth on port 54545. Add claude-config
named volume mounted at ~/.claude/ in both claude and webui services so
credentials persist across container runs. Pre-create ~/.claude/ in the
Dockerfile so the volume is initialised with correct ownership. Add
--service-ports to docker compose run calls to publish port 54545 during
CLI sessions.

README.md

@@ -47,14 +47,46 @@ Runs [Claude Code](https://claude.ai/code) inside an isolated Docker environment
 # 1. Clone / copy this repo
 git clone <repo> docker-claude && cd docker-claude
 
-# 2. Configure credentials
+# 2. Configure credentials (see Authentication below)
 cp .env.example .env
-$EDITOR .env   # set ANTHROPIC_API_KEY (and WEBUI_PASSWORD if using web mode)
+$EDITOR .env
 
 # 3. Make the control script executable
 chmod +x claude.sh
 ```
 
+## Authentication
+
+Three options — pick one and set it in `.env`:
+
+### Option 1 — API key
+```bash
+ANTHROPIC_API_KEY=sk-ant-...
+```
+
+### Option 2 — OAuth token (subscription, headless-friendly)
+
+Run this **on your host** (not inside the container) to generate a 1-year token:
+```bash
+claude setup-token
+```
+Then set the printed token in `.env`:
+```bash
+CLAUDE_CODE_OAUTH_TOKEN=...
+```
+
+### Option 3 — Browser OAuth (interactive)
+
+Leave both keys unset. On first run, Claude Code will print a login URL.
+Port 54545 must be reachable from your browser for the OAuth callback:
+
+```bash
+sbx ports <sandbox-name> --publish 54545:54545/tcp
+```
+
+Then run `./claude.sh run` and follow the prompt. Credentials are stored in the
+`claude-config` Docker volume and reused on every subsequent run.
+
 ## Usage
 
 ### CLI mode