Project repo_url: worker can run tasks from any git repo

Projects gain repo_url (validated: https:// or git@ only, no
userinfo/password, no file:// or local paths; old DBs get the
column via idempotent ALTER in both SQLite and Postgres init).
Worker resolves a project's repo_url to a local checkout under
--repos-dir (default ./repos) before dispatch: clone if absent,
verify remote origin matches and fetch if present, never force
reset/clean, never push (push needs write credentials the
control plane does not store). Resolve failure fails the task
with a clear error, never completed. Docker workers need
repos_dir under a same-path extra mount (e.g.
/var/lib/codex-app-server/repos).
Also: driver-missing test is now mocked instead of depending
on the host really having no psycopg driver installed.
Deploy package: Caddyfile template exposing only /webhooks/*
and /oauth/* (tasks/projects/admin stay 403) plus a
webhook-secret generator script that never prints the secret.
Tests: host 27 pass, cloud 286 pass (8 skipped are
environment-dependent real-Postgres tests).

deploy/caddy/Caddyfile

@@ -0,0 +1,27 @@
+# 公网入口模板：只暴露 webhook 与 OAuth 回调，任务/项目/管理 API 不对外。
+# 使用前把 <DOMAIN> 换成你自己的域名，把 <EMAIL> 换成 Let's Encrypt 联系邮箱。
+# 部署侧在主机上装 Caddy 后，把本文件放到 /etc/caddy/Caddyfile 并 reload。
+# 控制面本身仍只监听 127.0.0.1:8765，不直接对外；Caddy 只做反向代理 + TLS。
+# GitHub webhook 与 OAuth 回调都要求 https 且证书有效，Caddy 的自动证书满足这一点；
+# 自签名证书不行，GitHub 会拒绝送达，浏览器也会拦截 OAuth 回调。
+
+<DOMAIN> {
+    encode gzip
+    tls <EMAIL>
+
+    # GitHub webhook：签名校验在控制面做（GITHUB_WEBHOOK_SECRET），Caddy 只转发。
+    @github path /webhooks/github
+    reverse_proxy @github 127.0.0.1:8765
+
+    # Slack webhook（目前只有解析，未接执行；先留着入口，执行接通后再用）。
+    @slack path /webhooks/slack
+    reverse_proxy @slack 127.0.0.1:8765
+
+    # OAuth 浏览器登录/回调：回调 URL 必须与 OAuth App 里填的完全一致，
+    # 即 https://<DOMAIN>/oauth/<provider>/callback。
+    @oauth path /oauth/*
+    reverse_proxy @oauth 127.0.0.1:8765
+
+    # 其余一切（/tasks、/projects、/admin/*、/metrics 等）一律不对公网开放。
+    respond "forbidden" 403
+}

deploy/setup-webhook-secret.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# 在主机上生成 GitHub webhook secret 并写入 /etc/codex-app-server/env，绝不打印 secret。
+# 用法（主机 root 执行）：sh deploy/setup-webhook-secret.sh
+# 效果：若 env 文件里已有 GITHUB_WEBHOOK_SECRET 则不动它并退出（避免轮换后 GitHub 端旧 secret 失效）；
+# 否则生成 32 字节随机 hex，追加到 env 文件，重启 codex-cloud-server。
+# 生成的 secret 只存在主机 env 文件里（0600 root），不要把它发回聊天、不要写进仓库。
+set -eu
+ENV_FILE=/etc/codex-app-server/env
+if grep -q '^GITHUB_WEBHOOK_SECRET=' "$ENV_FILE" 2>/dev/null; then
+  echo "GITHUB_WEBHOOK_SECRET already set, leaving it unchanged."
+  exit 0
+fi
+SECRET=$(openssl rand -hex 32)
+printf 'GITHUB_WEBHOOK_SECRET=%s\n' "$SECRET" >> "$ENV_FILE"
+chmod 600 "$ENV_FILE"
+systemctl restart codex-cloud-server
+echo "Webhook secret generated and stored in $ENV_FILE only; server restarted."
+echo "Next step: paste the same secret into GitHub repo Settings -> Webhooks -> Secret (the value is on the host only, read it from $ENV_FILE as root if you need to copy it)."