Support Codex OAuth login and add CLI setup docs

src/db.ts

@@ -7,6 +7,30 @@ const password = process.env.MYSQL_PASSWORD || '';
 
 let pool: mysql.Pool | null = null;
 
+async function ensureColumn(
+  db: mysql.PoolConnection,
+  tableName: string,
+  columnName: string,
+  definition: string
+): Promise<void> {
+  const [rows] = await db.execute<mysql.RowDataPacket[]>(
+    `
+      SELECT COLUMN_NAME
+      FROM INFORMATION_SCHEMA.COLUMNS
+      WHERE TABLE_SCHEMA = DATABASE()
+        AND TABLE_NAME = ?
+        AND COLUMN_NAME = ?
+    `,
+    [tableName, columnName]
+  );
+
+  if (Array.isArray(rows) && rows.length > 0) {
+    return;
+  }
+
+  await db.execute(`ALTER TABLE \`${tableName}\` ADD COLUMN \`${columnName}\` ${definition}`);
+}
+
 export function getPool(): mysql.Pool {
   if (!pool) {
     throw new Error('Database pool not initialized. Call initDatabase() first.');
@@ -57,12 +81,19 @@ export async function initDatabase(): Promise<void> {
         code VARCHAR(255) PRIMARY KEY,
         client_id VARCHAR(255),
         redirect_uri TEXT,
+        scope TEXT NULL,
+        code_challenge TEXT NULL,
+        code_challenge_method VARCHAR(20) NULL,
         expires_at TIMESTAMP,
         used BOOLEAN DEFAULT FALSE,
         INDEX idx_expires (expires_at)
       )
     `);
 
+    await ensureColumn(db, 'oauth_auth_codes', 'scope', 'TEXT NULL');
+    await ensureColumn(db, 'oauth_auth_codes', 'code_challenge', 'TEXT NULL');
+    await ensureColumn(db, 'oauth_auth_codes', 'code_challenge_method', 'VARCHAR(20) NULL');
+
     await db.execute(`
       CREATE TABLE IF NOT EXISTS oauth_tokens (
         token VARCHAR(255) PRIMARY KEY,