feat(settings): make Claude Code OAuth token configurable in UI

The OAuth token that authenticates the spawned `claude` CLI was only
readable from the container env, so an expired token meant editing
.env on the Unraid host and rebuilding. Now it can be rotated from
the Settings page like every other key.

- Adds CLAUDE_CODE_OAUTH_TOKEN to the settings registry and a "Claude"
  card at the top of the settings UI.
- loadPipelineEnv() injects the DB value into every spawned subprocess
  env (overrides the container env), covering both campaign launches
  and chat sessions.
- checkIntegrationStatus() validates the token by hitting the Anthropic
  messages API with a 1-token call, surfacing 401s as "Token expired
  or invalid" instead of a generic "Not connected".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/(dashboard)/settings/page.tsx

@@ -28,6 +28,13 @@ interface SettingConfig {
 }
 
 const SETTINGS_GROUPS: SettingsGroup[] = [
+  {
+    name: "Claude",
+    description:
+      "OAuth access token for the Claude Code CLI subprocess that drives every pipeline agent. Tokens expire — refresh here when launches start failing with auth errors.",
+    docsUrl: "https://docs.claude.com/en/docs/claude-code/setup",
+    keys: ["CLAUDE_CODE_OAUTH_TOKEN"],
+  },
   {
     name: "Postiz",
     description:
@@ -59,6 +66,11 @@ const SETTINGS_GROUPS: SettingsGroup[] = [
 ];
 
 const SETTINGS_CONFIG: Record<string, SettingConfig> = {
+  CLAUDE_CODE_OAUTH_TOKEN: {
+    label: "Claude Code OAuth Token",
+    placeholder: "sk-ant-oat01-...",
+    secret: true,
+  },
   POSTIZ_URL: { label: "Postiz URL", placeholder: "http://localhost:5000" },
   POSTIZ_API_KEY: {
     label: "Postiz API Key",