feat: non-root container, reusable SSO flow, OIDC access detection

Security:
- Container now runs as non-root user 'provision' (CMMC/STIG audit
  requirement). Root execution would fail security audits.
- BW state persisted in named volume at /home/provision/.config/
  Bitwarden CLI to avoid slow re-auth on every run.

SSO refactoring:
- cloudron_panel_login(): establishes Cloudron panel session once,
  shared across all subsequent app SSO flows
- sso_login(): clicks app-specific SSO/OAuth button, handles Cloudron
  OIDC login + consent redirect, properly detects failures
- Detects "You do not have access" OIDC rejections (access control
  issue, not a selector bug)
- Per-app SSO button selectors passed as parameters for extensibility
  to future Cloudron apps (Dolibarr, Paperless, Firefly, etc.)

Debug:
- _debug_dump() captures screenshot + DOM at failure points
- Added dumps at Gitea token, Redmine key, and SSO failure locations

Current blocker: vp-techops Cloudron user not yet granted access to
Gitea/Redmine/Discourse apps. Cloudron 2FA confirmation pending.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

Dockerfile

@@ -23,7 +23,15 @@ RUN wget -q -O /tmp/bw.zip \
 COPY requirements.txt /tmp/
 RUN python3 -m pip install --no-cache-dir --break-system-packages -r /tmp/requirements.txt
 
+# Create non-root user for Playwright
+RUN groupadd -r provision && useradd -r -g provision -G audio,video -m -d /home/provision provision \
+    && mkdir -p /home/provision/.config \
+    && chown -R provision:provision /home/provision
+
 WORKDIR /app
 COPY . .
+RUN chown -R provision:provision /app
+
+USER provision
 
 ENTRYPOINT ["python3", "/app/provision-agent.py"]