feat: replace Node.js bw CLI with native Rust binary + fix module name

Replace npm-based @bitwarden/cli with the pre-compiled native Rust bw
binary (v2026.7.0) to eliminate Node.js from the credential management
layer for CMMC/ITAR/STIG audit readiness.

Changes:
- Dockerfile: download native bw binary instead of npm install; add
  python3-pip for Playwright dependencies
- bw_helper.py: renamed from bw-helper.py (Python can't import hyphens);
  added BW_SERVER config for self-hosted instance; use --passwordfile
  for unlock (more reliable with native binary); removed TOTP from
  login flow (API key auth does not require it)
- provision-agent.py: pass BW_SERVER env var to BitwardenHelper
- docker-compose.yml: add BW_SERVER env var
- .env.example: add BW_SERVER, document TOTP as optional

Verified: dry-run passes, bw status/auth/generate all work inside
the provisioner container against pwvault.turnsys.com.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

provision-agent.py

@@ -620,6 +620,7 @@ def main():
         client_secret=os.environ["BW_CLIENTSECRET"],
         password=os.environ["BW_PASSWORD"],
         totp_secret=os.environ.get("BW_TOTP_SECRET", ""),
+        server_url=os.environ.get("BW_SERVER", ""),
     )
     log.info("Connecting to Bitwarden...")
     bw.login()