fix: get_totp exact-name resolution + all-agent login validator

bw's name search is fuzzy: every agent email contains "coo"
(tsgstaff-coo-*), so `bw get totp "coo Cloudron"` matched 10 items and
errored. get_totp now resolves via get_item_id (exact-name filter)
first, mirroring get_item_password.

Added validate-all-logins.py: per-agent fresh-browser-context login
(shared contexts carry session cookies and hide the login form),
asserts password+TOTP round-trip, then verifies every stored API
credential against its system. First full run: 9/10 PASS.

Known failure: vp-compliance stored password does not match the
account ("Incorrect username or password" pre-TOTP) -- enrollment
typed a different value than stored. Needs Cloudron admin reset,
then update_item and re-validate.

docker-compose.yml

@@ -23,3 +23,6 @@ services:
       - ./provision-redmine.py:/app/provision-redmine.py:ro
       - ./merge-invites.py:/app/merge-invites.py:ro
       - ./dump-invite-page.py:/app/dump-invite-page.py:ro
+      - ./validate-all-logins.py:/app/validate-all-logins.py:ro
+      - ./diagnose-vp-compliance.py:/app/diagnose-vp-compliance.py:ro
+      - ./validate-coo.py:/app/validate-coo.py:ro