docs(env): documented .env.example, token-based claude auth in README

Every variable the compose file, the gateway and config.py read, grouped
and explained, including the ones the Jarvis rework will need
(CLAUDE_CODE_OAUTH_TOKEN, TELEGRAM_*, T3_*, KOMODO_*).

README.md

@@ -18,7 +18,7 @@ Uses Claude Code and Raycast subscriptions for agents, has some MCPs set up. You
 
 ```bash
 cp .env.example .env
-# fill CHANGE-ME
+# every empty value is documented inline; secrets: openssl rand -hex 32
 nvim .env
 
 # build raycast config on your mac (beta by default, consider checking raycast-api for instructions)
@@ -53,12 +53,10 @@ docker restart beaver-obsidian
 
 ### 3. Set up claude
 
-```bash
-docker exec -it beaver-gateway claude /login
-docker exec -it beaver-gateway bash -c 'cd /vault && claude --dangerously-skip-permissions --model claude-opus-4-7'
-```
-
-Click through every dialog, then `/exit` or Ctrl+C.
+On your mac run `claude setup-token` and put the result into `.env` as
+`CLAUDE_CODE_OAUTH_TOKEN`. That is the whole auth: no `/login` inside the
+container, no dialogs. The token draws from your subscription limits like
+regular Claude Code; rotate it by running `claude setup-token` again.
 
 ### 4. Mint a token