fix: get_totp exact-name resolution + all-agent login validator

bw's name search is fuzzy: every agent email contains "coo"
(tsgstaff-coo-*), so `bw get totp "coo Cloudron"` matched 10 items and
errored. get_totp now resolves via get_item_id (exact-name filter)
first, mirroring get_item_password.

Added validate-all-logins.py: per-agent fresh-browser-context login
(shared contexts carry session cookies and hide the login form),
asserts password+TOTP round-trip, then verifies every stored API
credential against its system. First full run: 9/10 PASS.

Known failure: vp-compliance stored password does not match the
account ("Incorrect username or password" pre-TOTP) -- enrollment
typed a different value than stored. Needs Cloudron admin reset,
then update_item and re-validate.

bw_helper.py

@@ -127,8 +127,16 @@ class BitwardenHelper:
         return self._run_bw(["generate", "-ulns", "--length", str(length)])
 
     def get_totp(self, item_name: str) -> str:
-        """Get the current TOTP code for a Bitwarden item."""
-        return self._run_bw(["get", "totp", item_name])
+        """Get the current TOTP code for a Bitwarden item.
+
+        Resolves via exact-name match first -- bw's search is fuzzy and
+        shared substrings (e.g. "coo" in every tsgstaff-coo-* username)
+        make name-based gets ambiguous.
+        """
+        item_id = self.get_item_id(item_name)
+        if not item_id:
+            raise RuntimeError(f"Item '{item_name}' not found")
+        return self._run_bw(["get", "totp", item_id])
 
     # -------------------------------------------------------------------
     # Item ID resolution -- the safe way to reference items