feat(creds): centralize credentials to ~/.creds/, add KNELCredsManager

Rewire all MCP wrappers, docker-compose services, and validate scripts
to source credentials from ~/.creds/ instead of scattered per-service
.env files. This removes credential duplication and prepares for the
HashiCorp Vault migration.

Add KNELCredsManager under tooling-cli with:
- Containerized Bitwarden CLI (pinned image, host stays clean)
- scripts/bw wrapper with session management and data persistence
- README documenting credential layout, consumer wiring, and roadmap

Also fixes latent bug in MCP wrappers that were silently getting empty
creds from ambient shell env — they now explicitly source ~/.creds/.

Tracked in Redmine #407. Discourse: https://community.turnsys.com/t/308

💘 Generated with Crush

Assisted-by: Crush

tooling-cli/KNELCredsManager/scripts/bw

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# bw — Bitwarden CLI wrapper (Docker containerized, host stays clean).
+#
+# Usage:
+#   bw login           (interactive — prompts for email/master password/2FA)
+#   bw unlock          (interactive — prints export BW_SESSION=... line)
+#   bw unlock --raw    (prints only the session key, for scripting)
+#   bw list items
+#   bw get item <name-or-id>
+#   bw sync
+#   bw status
+#
+# Session management:
+#   After `bw unlock`, capture the session key:
+#     export BW_SESSION=$(bw unlock --raw)
+#   The wrapper passes BW_SESSION through automatically if already set.
+#
+# Data persistence:
+#   BW data.json lives at ~/.local/share/bw-cli/ mounted into the container,
+#   so login state persists across invocations.
+set -euo pipefail
+
+IMAGE="${BW_CLI_IMAGE:-reachableceo-bw-cli:2026.7.0}"
+DATA_DIR="${HOME}/.local/share/bw-cli"
+
+mkdir -p "$DATA_DIR"
+
+# Detect TTY for interactive commands (login, unlock)
+INTERACTIVE=""
+if [ -t 0 ] && [ -t 1 ]; then
+    INTERACTIVE="-it"
+fi
+
+# Pass BW_SESSION through if set
+SESSION_ARGS=()
+if [ -n "${BW_SESSION:-}" ]; then
+    SESSION_ARGS+=( -e "BW_SESSION=${BW_SESSION}" )
+fi
+
+CONTAINER_NAME="reachableceo-bw-cli-$(date +%s)"
+
+exec docker run --rm $INTERACTIVE \
+    --user "$(id -u):$(id -g)" \
+    --name "$CONTAINER_NAME" \
+    -e HOME=/home/bw \
+    -v "${DATA_DIR}:/home/bw/.config" \
+    "${SESSION_ARGS[@]}" \
+    "$IMAGE" "$@"