Add one-line setup for AI client global rules + MCP OAuth connection

[rahilp]

Problem

Connecting Second Brain to an AI tool currently requires several manual steps spread across docs and a wiki page: copy-pasting AI_Instructions/CLAUDE_INSTRUCTIONS.md into ~/.claude/CLAUDE.md, copy-pasting Codex-style instructions into ~/.codex/AGENTS.md, and manually registering the /mcp endpoint with each CLI. This friction is exactly what Second Brain should remove.

Proposal

Ship a single terminal one-liner (with bash + PowerShell variants, mirroring rustup/bun.sh-style installers) that, given only the worker URL:

1. Appends (idempotently, never overwrites) the mandatory system instructions to ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md
2. Registers the /mcp endpoint as an MCP server for both Claude Code and Codex CLI using OAuth — no bearer token ever touches the script, shell history, or a config file

Verified live against the deployed worker

• claude mcp add --transport http second-brain "<url>/mcp" (no header) correctly triggers discovery → dynamic client registration → browser-based OAuth login, and the resulting connection works.
• codex mcp add second-brain --url "<url>/mcp" auto-detects OAuth support and starts the login flow itself (no separate login step needed), and the resulting connection works.
• ~/.codex/AGENTS.md is the genuine global-instructions file for Codex CLI, loaded automatically on startup — the same role ~/.claude/CLAUDE.md plays for Claude Code.

New/changed files

• scripts/connect-ai-clients.sh
• scripts/connect-ai-clients.ps1
• AI_Instructions/CODEX_INSTRUCTIONS.md (derived from CLAUDE_INSTRUCTIONS.md)
• README.md — replace the manual "connect your AI tools" step with the one-liners, and correct the OAuth section's now-outdated claim that the CLI clients "keep using the Authorization: Bearer header, no change needed"

Script behavior highlights

• Idempotent append using <!-- second-brain:instructions:start/end --> markers, plus detection of pre-existing unmarked manual installs to avoid duplicating content
• Detects already-registered MCP servers and skips cleanly instead of erroring on re-runs
• Validates the worker URL has a scheme before use
• Skips silently (with a one-line note) for whichever CLI isn't installed
• Ends with reminders about the one-time browser OAuth handshake and about the ChatGPT/Claude apps needing manual paste (no public write API for their personalization settings)