feat(creds): centralize credentials to ~/.creds/, add KNELCredsManager

Rewire all MCP wrappers, docker-compose services, and validate scripts
to source credentials from ~/.creds/ instead of scattered per-service
.env files. This removes credential duplication and prepares for the
HashiCorp Vault migration.

Add KNELCredsManager under tooling-cli with:
- Containerized Bitwarden CLI (pinned image, host stays clean)
- scripts/bw wrapper with session management and data persistence
- README documenting credential layout, consumer wiring, and roadmap

Also fixes latent bug in MCP wrappers that were silently getting empty
creds from ambient shell env — they now explicitly source ~/.creds/.

Tracked in Redmine #407. Discourse: https://community.turnsys.com/t/308

💘 Generated with Crush

Assisted-by: Crush

mcp-discourse-wrapper.sh

@@ -14,6 +14,14 @@ if docker ps -a --filter "name=${CONTAINER_NAME}" --format '{{.Names}}' 2>/dev/n
     done
 fi
 
+# Load credentials from central store
+CREDS_FILE="/home/reachableceo/.creds/discourse.env"
+if [ -f "$CREDS_FILE" ]; then
+    set -a
+    . "$CREDS_FILE"
+    set +a
+fi
+
 # Start MCP server with explicit name and environment variables
 exec docker run -i --rm --name "${CONTAINER_NAME}" \
     -e "DISCOURSE_URL=${DISCOURSE_URL:-}" \