feat(creds): centralize credentials to ~/.creds/, add KNELCredsManager

Rewire all MCP wrappers, docker-compose services, and validate scripts
to source credentials from ~/.creds/ instead of scattered per-service
.env files. This removes credential duplication and prepares for the
HashiCorp Vault migration.

Add KNELCredsManager under tooling-cli with:
- Containerized Bitwarden CLI (pinned image, host stays clean)
- scripts/bw wrapper with session management and data persistence
- README documenting credential layout, consumer wiring, and roadmap

Also fixes latent bug in MCP wrappers that were silently getting empty
creds from ambient shell env — they now explicitly source ~/.creds/.

Tracked in Redmine #407. Discourse: https://community.turnsys.com/t/308

💘 Generated with Crush

Assisted-by: Crush

discourse-cli/validate.sh

@@ -10,9 +10,11 @@ set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 cd "$SCRIPT_DIR"
 
-# Ensure .env exists
-if [ ! -f .env ]; then
-    echo "FAIL: .env not found. Copy .env.example to .env and fill in real values."
+ENV_FILE="${DISCOURSE_ENV_FILE:-/home/reachableceo/.creds/discourse.env}"
+
+# Ensure env file exists
+if [ ! -f "$ENV_FILE" ]; then
+    echo "FAIL: env file not found: $ENV_FILE"
     exit 1
 fi
 
@@ -36,9 +38,9 @@ echo ""
 echo "--- [0] Credential check (raw HTTP via containerized curl) ---"
 
 # Load env vars from .env for the raw test
-DISCOURSE_URL=$(grep -E '^DISCOURSE_URL=' .env | cut -d= -f2-)
-DISCOURSE_API_KEY=$(grep -E '^DISCOURSE_API_KEY=' .env | cut -d= -f2-)
-DISCOURSE_API_USERNAME=$(grep -E '^DISCOURSE_API_USERNAME=' .env | cut -d= -f2-)
+DISCOURSE_URL=$(grep -E '^DISCOURSE_URL=' "$ENV_FILE" | cut -d= -f2-)
+DISCOURSE_API_KEY=$(grep -E '^DISCOURSE_API_KEY=' "$ENV_FILE" | cut -d= -f2-)
+DISCOURSE_API_USERNAME=$(grep -E '^DISCOURSE_API_USERNAME=' "$ENV_FILE" | cut -d= -f2-)
 
 HTTP_CODE=$(docker run --rm curlimages/curl:latest \
     -s -o /dev/null -w '%{http_code}' \
@@ -67,7 +69,7 @@ echo ""
 # 1. whoami (live connection test)
 # ---------------------------------------------------------------- #
 echo "--- [1] whoami ---"
-OUT=$(docker run --rm --env-file .env "${IMAGE}" whoami 2>&1) || true
+OUT=$(docker run --rm --env-file "$ENV_FILE" "${IMAGE}" whoami 2>&1) || true
 if echo "$OUT" | grep -qE '^username:'; then
     ok "whoami returned user info"
     echo "  $OUT" | head -5
@@ -81,7 +83,7 @@ echo ""
 # 2. categories (live read)
 # ---------------------------------------------------------------- #
 echo "--- [2] categories ---"
-OUT=$(docker run --rm --env-file .env "${IMAGE}" categories 2>&1) || true
+OUT=$(docker run --rm --env-file "$ENV_FILE" "${IMAGE}" categories 2>&1) || true
 if echo "$OUT" | grep -qE '^[0-9]+ category'; then
     ok "categories returned data"
     echo "  $OUT" | head -6
@@ -98,7 +100,7 @@ echo ""
 # 3. topics / ls (live read)
 # ---------------------------------------------------------------- #
 echo "--- [3] topics (latest) ---"
-OUT=$(docker run --rm --env-file .env "${IMAGE}" ls 2>&1) || true
+OUT=$(docker run --rm --env-file "$ENV_FILE" "${IMAGE}" ls 2>&1) || true
 if echo "$OUT" | grep -qE 'topic\(s\)'; then
     ok "topics list returned data"
     echo "  $OUT" | head -6
@@ -115,7 +117,7 @@ echo ""
 # ---------------------------------------------------------------- #
 if [ -n "${TOPIC_ID:-}" ]; then
     echo "--- [4] show topic ${TOPIC_ID} ---"
-    OUT=$(docker run --rm --env-file .env "${IMAGE}" show "${TOPIC_ID}" 2>&1) || true
+    OUT=$(docker run --rm --env-file "$ENV_FILE" "${IMAGE}" show "${TOPIC_ID}" 2>&1) || true
     if echo "$OUT" | grep -qE '^#'; then
         ok "show topic ${TOPIC_ID} returned content"
         echo "  $OUT" | head -8
@@ -132,7 +134,7 @@ echo ""
 # 5. search (live read)
 # ---------------------------------------------------------------- #
 echo "--- [5] search ---"
-OUT=$(docker run --rm --env-file .env "${IMAGE}" search "test" 2>&1) || true
+OUT=$(docker run --rm --env-file "$ENV_FILE" "${IMAGE}" search "test" 2>&1) || true
 if echo "$OUT" | grep -qE 'result\(s\)'; then
     ok "search returned results"
     echo "  $OUT" | head -5
@@ -147,7 +149,7 @@ echo ""
 # ---------------------------------------------------------------- #
 echo "--- [6] create + reply + update + delete (write cycle) ---"
 
-CREATE_OUT=$(docker run --rm --env-file .env "${IMAGE}" create \
+CREATE_OUT=$(docker run --rm --env-file "$ENV_FILE" "${IMAGE}" create \
     ${CAT_ID:+-c "$CAT_ID"} \
     -t "discourse-cli validation test $(date +%s)" \
     -b "This is an automated validation test post. It will be cleaned up shortly after creation." \
@@ -159,7 +161,7 @@ if [ -n "${NEW_TOPIC_ID:-}" ]; then
     echo "  $CREATE_OUT"
 
     # reply
-    REPLY_OUT=$(docker run --rm --env-file .env "${IMAGE}" reply "${NEW_TOPIC_ID}" \
+    REPLY_OUT=$(docker run --rm --env-file "$ENV_FILE" "${IMAGE}" reply "${NEW_TOPIC_ID}" \
         -b "Validation reply test." 2>&1) || true
     POST_ID=$(echo "$REPLY_OUT" | grep -oE 'id=[0-9]+' | grep -oE '[0-9]+')
     if echo "$REPLY_OUT" | grep -qE 'Posted reply'; then
@@ -172,7 +174,7 @@ if [ -n "${NEW_TOPIC_ID:-}" ]; then
 
     # update
     if [ -n "${POST_ID:-}" ]; then
-        UPD_OUT=$(docker run --rm --env-file .env "${IMAGE}" update "${POST_ID}" \
+        UPD_OUT=$(docker run --rm --env-file "$ENV_FILE" "${IMAGE}" update "${POST_ID}" \
             -b "Updated validation reply test." 2>&1) || true
         if echo "$UPD_OUT" | grep -qE 'Updated post'; then
             ok "update post ${POST_ID} succeeded"
@@ -182,7 +184,7 @@ if [ -n "${NEW_TOPIC_ID:-}" ]; then
         fi
 
         # delete
-        DEL_OUT=$(docker run --rm --env-file .env "${IMAGE}" delete "${POST_ID}" 2>&1) || true
+        DEL_OUT=$(docker run --rm --env-file "$ENV_FILE" "${IMAGE}" delete "${POST_ID}" 2>&1) || true
         if echo "$DEL_OUT" | grep -qE 'Deleted post'; then
             ok "delete post ${POST_ID} succeeded"
         else