docs: document --enable-opencode flag for gated OpenCode API proxy port

Port 10004 (OpenCode) in the API proxy sidecar is now gated behind an
explicit --enable-opencode flag (requires --enable-api-proxy). Update
docs to reflect this.

- docs/usage.md: add --enable-opencode to flag reference
- docs/api-proxy-sidecar.md: note port 10004 requires --enable-opencode
- docs/awf-config-spec.md: add apiProxy.enableOpenCode CLI mapping

Triggered by: bab8694 (fix: gate OpenCode listener on AWF_ENABLE_OPENCODE flag)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]

docs/api-proxy-sidecar.md

@@ -310,7 +310,7 @@ The sidecar container:
 - **Image**: `ghcr.io/github/gh-aw-firewall/api-proxy:latest`
 - **Base**: `node:22-alpine`
 - **Network**: `awf-net` at `172.30.0.30`
-- **Ports**: 10000 (OpenAI), 10001 (Anthropic), 10002 (GitHub Copilot), 10003 (Google Gemini), 10004 (OpenCode)
+- **Ports**: 10000 (OpenAI), 10001 (Anthropic), 10002 (GitHub Copilot), 10003 (Google Gemini), 10004 (OpenCode, requires `--enable-opencode`)
 - **Proxy**: Routes via Squid at `http://172.30.0.10:3128`
 
 ### Health check

docs/awf-config-spec.md

@@ -67,6 +67,7 @@ Tools generating AWF invocations (such as `gh-aw`) SHOULD use this mapping:
 - `network.dnsServers[]` → `--dns-servers <csv>`
 - `network.upstreamProxy` → `--upstream-proxy`
 - `apiProxy.enabled` → `--enable-api-proxy`
+- `apiProxy.enableOpenCode` → `--enable-opencode`
 - `apiProxy.targets.<provider>.host` → `--<provider>-api-target`
 - `apiProxy.targets.openai.basePath` → `--openai-api-base-path`
 - `apiProxy.targets.anthropic.basePath` → `--anthropic-api-base-path`

docs/usage.md

@@ -97,6 +97,9 @@ Options:
   --gemini-api-target <host>   Target hostname for Gemini API requests
                                (default: generativelanguage.googleapis.com)
   --gemini-api-base-path <path> Base path prefix for Gemini API requests
+  --enable-opencode            Enable OpenCode API proxy listener on port 10004
+                               (requires --enable-api-proxy). Only start this when the
+                               workflow uses the OpenCode engine. (default: false)
   --rate-limit-rpm <n>         Max requests per minute per provider (requires --enable-api-proxy)
   --rate-limit-rph <n>         Max requests per hour per provider (requires --enable-api-proxy)
   --rate-limit-bytes-pm <n>    Max request bytes per minute per provider (requires --enable-api-proxy)