feat(config): align config.json with claude-openmax / openmax-bridge …

[Noah-Bytes]

…format

Migrate the external config from the old { cws, codex, bridge, org } shape to the bridge format { enabled, server, agent, cf_access, orgs } so per-org access policy (dm + group) can be expressed and passed to the SDK's CwsAgentBridge as orgConfigs. Preserves codex-openmax's runtime-specific codex:{bin,cwd} and bridge:{localHttpPort} blocks.

• config.ts: parse the new shape, expose camelCase runtime fields (server/agent), org_id-keyed orgs map -> array with full access, keep codex + local port; env overrides + strict validation retained.
• cli.ts: build orgConfigs from the orgs map (full access, enabled filter), thread cf_access into token/http/ws; device_id/app_version from agent.*.
• onboarding.ts: emit the new shape with a COMPLETE access block (dmPolicy/dmAllowFrom/groupPolicy/groups); both credential paths.
• config.example.json: bridge-format template + codex fields.
• tests: config/onboarding updated to the new shape.

What

Why

Test plan

• npm test passes locally
• npm run build passes locally

Checklist

• No secrets / credentials committed
• Semgrep / Gitleaks findings addressed, or a // nosemgrep: <rule-id> suppression is justified inline and approved by the project lead

[gavin09527]

LGTM ✅ 过了完整 diff。

配置从旧的 {cws,codex,bridge,org} 迁到 bridge 格式 {enabled,server,agent,cf_access,orgs}，对齐 claude-openmax，同时保留 codex-openmax 特有的 codex/bridge 两块。关键点都对：

• parseOrgs 把 org_id-keyed map 规范成数组，access(dm+group) 原样透传给 SDK 的 orgConfigs，补上了旧 {dmPolicy}-only 表达不了的群策略
• cf_access 只有在 client_id 非空时才 surface（避免发空 CF 头），且按 SDK cfAccessHeaders() 的期望 wrap 成 {cf_access}
• activeOrgs = enabled!==false 过滤，多 org 一起进 orgConfigs；defaultOrgId 有兜底
• REQUIRED / env override 保留；device_id/app_version 从 agent.* 取
• onboarding + config.example + 测试都同步了

CI 全绿（Test / Semgrep / Gitleaks 均 pass），mergeable。已 approve。