docs: Document Todoist OAuth auth setup

[amix]

Context

Follow-up to the Todoist OAuth implementation PR.

What was changed

• Clarifies the default Comms OAuth grant
• Documents supported non-production OAuth hosts
• Notes that custom Comms hosts should use COMMS_API_TOKEN

Testing

• npm run lint:check
• doistbot review staged (one local pass, copy issue addressed)

[doistbot]

Thanks Amir for documenting the Todoist OAuth setup and fallback behaviors 😊.

Few things worth tightening:

• Clarify that custom hosts also require COMMS_BASE_URL alongside COMMS_API_TOKEN so requests aren't mistakenly routed to production.
• Sync the new auth documentation to src/lib/skills/content.ts and regenerate SKILL.md so the agent-facing docs match the README.

_{Share Feedback • Review Logs}

[amix]

Posted by Claude Code/Codex on behalf of Amir:

Addressed the Doistbot notes in this stacked docs PR:

• The README now calls out that custom Comms hosts need COMMS_BASE_URL alongside COMMS_API_TOKEN.
• The agent-facing skill docs were synced via src/lib/skills/content.ts and regenerated skills/comms-cli/SKILL.md.

Not requesting another Doistbot round per Amir's direction.