fix: Cloudron selectors, docker-compose env_file, CLOUDRON_BASE URL

- Fix Cloudron invite form selectors to match real page IDs
  (#inputUsername, #inputDisplayName, #inputPassword, #inputPasswordRepeat)
- Fix docker-compose.yml: use env_file instead of ${VAR} interpolation
  (password contains $ chars that docker-compose corrupts)
- Update CLOUDRON_BASE from tsys-cloudron.knel.net to my.knownelement.com

Phase 1 Cloudron enrollment now works end-to-end: invite accepted,
password set, TOTP extracted, credential stored in Bitwarden.
Phase 2 (Gitea/Redmine/Discourse) needs selector updates for
the current UI versions of each system.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

docker-compose.yml

@@ -2,13 +2,8 @@ services:
   provision:
     build: .
     container_name: tsys-agent-provisioner
-    environment:
-      - BW_CLIENTID=${BW_CLIENTID}
-      - BW_CLIENTSECRET=${BW_CLIENTSECRET}
-      - BW_PASSWORD=${BW_PASSWORD}
-      - BW_SERVER=${BW_SERVER:-https://pwvault.turnsys.com}
-      - BW_TOTP_SECRET=${BW_TOTP_SECRET:-}
-      - HEADFUL=${HEADFUL:-false}
+    env_file:
+      - ${BW_ENV_FILE:-${HOME}/.config/bw/env}
     volumes:
       - ./agents.yaml:/app/agents.yaml:ro
       - ./state:/app/state