feat(creds): centralize credentials to ~/.creds/, add KNELCredsManager

Rewire all MCP wrappers, docker-compose services, and validate scripts
to source credentials from ~/.creds/ instead of scattered per-service
.env files. This removes credential duplication and prepares for the
HashiCorp Vault migration.

Add KNELCredsManager under tooling-cli with:
- Containerized Bitwarden CLI (pinned image, host stays clean)
- scripts/bw wrapper with session management and data persistence
- README documenting credential layout, consumer wiring, and roadmap

Also fixes latent bug in MCP wrappers that were silently getting empty
creds from ambient shell env — they now explicitly source ~/.creds/.

Tracked in Redmine #407. Discourse: https://community.turnsys.com/t/308

💘 Generated with Crush

Assisted-by: Crush

docker-compose.yml

@@ -282,10 +282,8 @@ services:
       dockerfile: ../../dockerfiles/discourse-mcp/Dockerfile
     container_name: kneldevstack-aimiddleware-discourse-mcp
     restart: unless-stopped
-    environment:
-      - DISCOURSE_URL=${DISCOURSE_URL}
-      - DISCOURSE_API_KEY=${DISCOURSE_API_KEY}
-      - DISCOURSE_API_USERNAME=${DISCOURSE_API_USERNAME}
+    env_file:
+      - /home/reachableceo/.creds/discourse.env
     profiles:
       - ops
 
@@ -398,10 +396,10 @@ services:
       dockerfile: ../../dockerfiles/mcp-redmine/Dockerfile
     container_name: kneldevstack-aimiddleware-mcp-redmine
     restart: "no"
+    env_file:
+      - /home/reachableceo/.creds/redmine.env
     environment:
       - PYTHONUNBUFFERED=1
-      - REDMINE_URL=${REDMINE_URL}
-      - REDMINE_API_KEY=${REDMINE_API_KEY}
     profiles:
       - ops
 
@@ -609,11 +607,10 @@ services:
       dockerfile: ../../dockerfiles/beszel-mcp/Dockerfile
     container_name: kneldevstack-aimiddleware-beszel-mcp
     restart: "no"
+    env_file:
+      - /home/reachableceo/.creds/beszel.env
     environment:
       - PYTHONUNBUFFERED=1
-      - BESZEL_URL=${BESZEL_URL}
-      - BESZEL_USERNAME=${BESZEL_USERNAME}
-      - BESZEL_PASSWORD=${BESZEL_PASSWORD}
     profiles:
       - ops