fix: handle 2FA on the Bitwarden account during API login [#442]

bw login --apikey prompts for a TOTP code when 2FA is enabled on the
BW account. The previous code didn't pass one, so it would hang or
fail. Now generates a TOTP from BW_TOTP_SECRET and passes via --code.

Changes:
- BitwardenHelper.__init__ accepts totp_secret param
- login() generates a pyotp code and passes --code when secret is set
- provision-agent.py passes BW_TOTP_SECRET from environment
- docker-compose.yml and .env.example updated for the new var
- BW_PASSWORD removed from the login env (only needed for unlock via stdin)

The BW account's own TOTP secret lives in ~/.config/bw/env alongside
the other BW access info — the one exception (can't store BW's 2FA in
BW itself).

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

provision-agent.py

@@ -619,6 +619,7 @@ def main():
         client_id=os.environ["BW_CLIENTID"],
         client_secret=os.environ["BW_CLIENTSECRET"],
         password=os.environ["BW_PASSWORD"],
+        totp_secret=os.environ.get("BW_TOTP_SECRET", ""),
     )
     log.info("Connecting to Bitwarden...")
     bw.login()