feat(reborn): WebChat v2 host gateway — serve loop + auth + routes

.env.example

@@ -295,5 +295,22 @@ SAFETY_INJECTION_CHECK_ENABLED=true
 # GATEWAY_OIDC_ISSUER=https://your-idp.example.com
 # GATEWAY_OIDC_AUDIENCE=your-client-id
 
+# ─── Reborn WebUI v2 (`ironclaw-reborn serve`) ─────────────────────────
+# The Reborn binary is separate from v1 and does not share auth/middleware
+# with the v1 channels/web stack. These variables configure the v2 native
+# HTTP surface owned by `crates/ironclaw_reborn_webui_ingress`. They have
+# no effect on the v1 binary.
+#
+# Bearer token consulted by `EnvBearerAuthenticator`. Keep this in the
+# environment ONLY — operators must NOT put the token value into
+# `config.toml`. The token is compared with `subtle::ConstantTimeEq` so
+# leading/trailing whitespace counts.
+# IRONCLAW_REBORN_WEBUI_TOKEN=replace-with-strong-random-token
+#
+# UserId stamped onto the `WebUiAuthenticatedCaller` when the bearer
+# token matches. Pair this with the tenant_id resolved from
+# `[identity].installation_tenant` in `config.toml`.
+# IRONCLAW_REBORN_WEBUI_USER_ID=reborn-cli-operator
+
 # Logging
 RUST_LOG=ironclaw=debug,tower_http=debug