skills: agent-provisioning - codified identity stand-up workflow

Policy rulings (#942): unique passwords, Cloudron-only SSO accounts,
no reachableceo credentials, TOTP seeds MUST be captured to the vault.
Cloudron admin API wrapper, cookie-jar OIDC login, RFC-6238-tested
TOTP helper, per-system SSO/API references, incident log.

skills/agent-provisioning/scripts/cloudron-api.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+# Authenticated Cloudron admin API call (compliant lever: api-token service
+# account from vault item creds/cloudron — never the founder's accounts).
+# usage: cloudron-api.sh METHOD /api/v1/PATH [JSON-BODY]
+# body -> stdout; HTTP status -> stderr. Secrets never printed.
+set -euo pipefail
+BASE="https://my.knownelement.com"
+METHOD="${1:?usage: cloudron-api.sh METHOD /api/v1/PATH [JSON-BODY]}"
+PATHPART="${2:?usage: cloudron-api.sh METHOD /api/v1/PATH [JSON-BODY]}"
+BODY="${3:-}"
+if [ "$(id -un)" = "TSGCOO" ]; then
+  SM() { /data2/TSGCOO/.local/bin/sm "$@" </dev/null; }
+else
+  SM() { sudo -u TSGCOO /data2/TSGCOO/.local/bin/sm "$@" </dev/null; }
+fi
+TOKEN=$(SM get creds/cloudron --field password)
+[ -n "$TOKEN" ] || { echo "no cloudron token in vault" >&2; exit 1; }
+ARGS=(-sk -X "$METHOD" "$BASE$PATHPART"
+      -H "Authorization: Bearer $TOKEN"
+      -H 'Content-Type: application/json'
+      -w '\nHTTP %{http_code}\n')
+[ -n "$BODY" ] && ARGS+=(-d "$BODY")
+curl "${ARGS[@]}" >&2