docs: split README and harden ChatGPT login handoff

Author: gaoguobin

.codex/SET_UPSTREAM.md

@@ -115,12 +115,30 @@ python -m codex_fast_proxy status
 
 Report the set-upstream JSON and the final status JSON. The key fields are `provider`, `base_url`,
 `previous_upstream_base`, `upstream_base`, `service_tier_policy`, `upstream_auth`, `config_matches`,
-`verification`, `restart_required`, and `start_result`.
+`verification`, `restart_required`, `start_result`, and `next_user_action`.
 
 Do not use `--restart` unless the user explicitly accepts that restarting the proxy can interrupt
 current proxy-backed Codex sessions. If `restart_required=true`, tell the user to restart Codex App,
 open a new CLI process, or run `python -m codex_fast_proxy start` later to apply the new upstream.
 
+For ChatGPT-login preparation, `restart_required=true` or final `status.needs_restart=true` is a
+hard stop before login. The provider auth split has been verified and saved, but the running proxy
+has not loaded the new auth override yet. Tell the user to restart Codex App, or explicitly allow
+`python -m codex_fast_proxy start`, before signing in with ChatGPT. Do not tell the user they can
+switch to ChatGPT login while `needs_restart=true`; model requests may still fail with 401.
+
+After provider auth split is active and final `status.needs_restart=false`, the user can sign in
+with ChatGPT if they want the full Codex App UI. Also mention this Windows login troubleshooting
+path: if ChatGPT login fails with `OSError: [WinError 10013] ... socket ...`, ask the user to retry
+after running these commands in an Administrator PowerShell:
+
+```powershell
+net stop winnat
+netsh interface ipv4 show excludedportrange protocol=tcp
+net start winnat
+netsh interface ipv4 show excludedportrange protocol=tcp
+```
+
 If the user changed API key environment variables, model, reasoning, or other Codex config, tell
 them to restart Codex App or open a new CLI process so Codex reloads those settings. The proxy can
 read Windows user environment variables directly when possible, but already-running Codex processes