feat: non-root container, reusable SSO flow, OIDC access detection

Security:
- Container now runs as non-root user 'provision' (CMMC/STIG audit
  requirement). Root execution would fail security audits.
- BW state persisted in named volume at /home/provision/.config/
  Bitwarden CLI to avoid slow re-auth on every run.

SSO refactoring:
- cloudron_panel_login(): establishes Cloudron panel session once,
  shared across all subsequent app SSO flows
- sso_login(): clicks app-specific SSO/OAuth button, handles Cloudron
  OIDC login + consent redirect, properly detects failures
- Detects "You do not have access" OIDC rejections (access control
  issue, not a selector bug)
- Per-app SSO button selectors passed as parameters for extensibility
  to future Cloudron apps (Dolibarr, Paperless, Firefly, etc.)

Debug:
- _debug_dump() captures screenshot + DOM at failure points
- Added dumps at Gitea token, Redmine key, and SSO failure locations

Current blocker: vp-techops Cloudron user not yet granted access to
Gitea/Redmine/Discourse apps. Cloudron 2FA confirmation pending.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

docker-compose.yml

@@ -4,7 +4,12 @@ services:
     container_name: tsys-agent-provisioner
     env_file:
       - ${BW_ENV_FILE:-${HOME}/.config/bw/env}
+    user: "provision"
     volumes:
       - ./agents.yaml:/app/agents.yaml:ro
       - ./state:/app/state
+      - tsys-bw-cli-state:/home/provision/.config/Bitwarden CLI
     network_mode: host
+
+volumes:
+  tsys-bw-cli-state: