feat: initial agent identity provisioning automation [#442]

Playwright-based tool for enrolling AI agent identities in Cloudron,
generating API keys via SSO (Gitea/Discourse/Redmine), and storing
all credentials in Bitwarden per-agent collections.

- provision-agent.py: main Playwright automation (Cloudron enroll,
  SSO login, API key generation, verification)
- bw-helper.py: Bitwarden CLI wrapper (password gen, item CRUD,
  TOTP, session management)
- Dockerfile: Playwright v1.52.0 + bw CLI + Python deps
- agents.yaml.example: manifest template for Q3/Q4 agents
- TSYSGroupAIOS framework adopted (hooks, rules engine, Makefile)

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

docker-compose.yml

@@ -0,0 +1,13 @@
+services:
+  provision:
+    build: .
+    container_name: tsys-agent-provisioner
+    environment:
+      - BW_CLIENTID=${BW_CLIENTID}
+      - BW_CLIENTSECRET=${BW_CLIENTSECRET}
+      - BW_PASSWORD=${BW_PASSWORD}
+      - HEADFUL=${HEADFUL:-false}
+    volumes:
+      - ./agents.yaml:/app/agents.yaml:ro
+      - ./state:/app/state
+    network_mode: host