feat(tools-pve): prepare LiteLLM gateway with persistent OAuth routes

servers/tools-pve/litellm/oauth-login.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IMAGE='ghcr.io/berriai/litellm:main-stable@sha256:3d88bd757134a00e8c00237b85a021ab1f6d54abb9c1df750f411dbe7256a500'
+case "${1:-}" in
+  codex)
+    CODE='from litellm.llms.chatgpt.authenticator import Authenticator; Authenticator().get_access_token(); print("Codex login complete")'
+    ;;
+  xai)
+    CODE='from litellm.llms.xai.oauth import XAIOAuthAuthenticator; XAIOAuthAuthenticator().login(no_browser=True); print("xAI login complete")'
+    ;;
+  *) printf 'Usage: bash oauth-login.sh codex|xai\n' >&2; exit 2 ;;
+esac
+# The helper shares only the proxy token volume, not its API keys or database.
+sudo docker run --rm -it --network host \
+  --mount type=volume,src=tools-litellm-oauth,dst=/tokens \
+  -e CHATGPT_TOKEN_DIR=/tokens/chatgpt -e XAI_OAUTH_TOKEN_DIR=/tokens/xai \
+  --entrypoint python "$IMAGE" -c "$CODE"
+printf 'Login persisted. Verify model IDs, then restart only the litellm service.\n'