docs(agents): add the Extensions page and the Sign in with ChatGPT guide

[NathanFlurry]

Extensions (/agents/docs/extensions, under Concepts → Agent) covers:

• what an extension holds: tools, sections, hooks, wraps, and tasks
• hooks, with a read-only example and a table of every hook
• wrapTool, with an audit example that logs bash commands
• choosing extensions per conversation: settings.extensions and conversation.configure by name
• deploys: the registry is per worker, conversations store only names, and tasks wait for their extension

Sign in with ChatGPT is the first Agents guide. It lives in docs/content/guides/ and the sidebar's new guides key, so the website merges it into the site-wide Guides tab at /guides/sign-in-with-chatgpt. A chatgptLogin Actor drives pi-ai's models.login("openai", "oauth") and saves the login to the per-user credentials Actor from User Subscriptions, which now links to the guide.

Notes:

• OpenAI's open-source Sign in with ChatGPT flow redirects to a fixed http://127.0.0.1:1455 callback, so on a remote worker the user pastes the redirect URL back. It is limited to open-source and self-hosted apps, which the guide says.
• pi-ai listens on port 1455 during a sign-in, so a worker runs one sign-in at a time. The example's prompt rejects on abort; otherwise a cancelled sign-in keeps the port bound until the process restarts.
• Tested locally: examples type-check, start returns a real OpenAI sign-in URL through the Actor, and a bad pasted URL fails cleanly. Not tested: a full sign-in with a real ChatGPT account.
• The guide imports the website's ExampleLinkBar component, like the dynamic-apps docs do, although docs/CLAUDE.md discourages website imports.

Merge order: merge rivet-dev/website#131 first, then rivet-dev/rivet#5853. With the old website code, this repo's content/guides/ folder would be unrouted.

[railway-app]

🚅 Environment agents-pr-348 in rivet-frontend has no services deployed.