Add ChatGPT OAuth tunnel support

[ibidathoillah]

Summary

Adds ChatGPT-ready OAuth tunnel support around the existing MCP HTTP bridge.

Changes

• Add docker-compose.chatgpt-tunnel.yml for running indodax-cli mcp --http behind Cloudflare Tunnel.
• Add docs/chatgpt-oauth-tunnel.md with setup, OAuth discovery checks, ChatGPT registration URLs, and security notes.
• Add openapi/chatgpt-actions.json for ChatGPT Actions with OAuth Authorization Code configuration.
• Keep safe default groups as market,account,paper,auth; live trade/funding require explicit opt-in.

Security defaults

• No --allow-dangerous in the ChatGPT tunnel compose file.
• BRIDGE_SECRET documented as optional and not recommended for ChatGPT OAuth because ChatGPT usually cannot send custom X-Bridge-Auth during OAuth discovery/token exchange.
• OAuth bearer token is used for private account actions; public market actions remain unauthenticated.

Test notes

Not run locally in this environment. Please verify with:

export MCP_PUBLIC_BASE_URL="https://your-domain.example.com"
export CLOUDFLARE_TUNNEL_TOKEN="..."
docker compose -f docker-compose.chatgpt-tunnel.yml up -d --build
curl "$MCP_PUBLIC_BASE_URL/health"
curl "$MCP_PUBLIC_BASE_URL/.well-known/oauth-protected-resource"
curl "$MCP_PUBLIC_BASE_URL/.well-known/oauth-authorization-server"