OAuth credentials shared with all agent containers via volume.
https://platform.claude.com/oauth/code/callback?...).claude setup-token run on a machine already logged into the right account — more reliable than the OAuth flow above, which can mint an account-limited token.