fix: handle 2FA on the Bitwarden account during API login [#442]

bw login --apikey prompts for a TOTP code when 2FA is enabled on the
BW account. The previous code didn't pass one, so it would hang or
fail. Now generates a TOTP from BW_TOTP_SECRET and passes via --code.

Changes:
- BitwardenHelper.__init__ accepts totp_secret param
- login() generates a pyotp code and passes --code when secret is set
- provision-agent.py passes BW_TOTP_SECRET from environment
- docker-compose.yml and .env.example updated for the new var
- BW_PASSWORD removed from the login env (only needed for unlock via stdin)

The BW account's own TOTP secret lives in ~/.config/bw/env alongside
the other BW access info — the one exception (can't store BW's 2FA in
BW itself).

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

docker-compose.yml

@@ -6,6 +6,7 @@ services:
       - BW_CLIENTID=${BW_CLIENTID}
       - BW_CLIENTSECRET=${BW_CLIENTSECRET}
       - BW_PASSWORD=${BW_PASSWORD}
+      - BW_TOTP_SECRET=${BW_TOTP_SECRET:-}
       - HEADFUL=${HEADFUL:-false}
     volumes:
       - ./agents.yaml:/app/agents.yaml:ro