feat: initial agent identity provisioning automation [#442]

Playwright-based tool for enrolling AI agent identities in Cloudron,
generating API keys via SSO (Gitea/Discourse/Redmine), and storing
all credentials in Bitwarden per-agent collections.

- provision-agent.py: main Playwright automation (Cloudron enroll,
  SSO login, API key generation, verification)
- bw-helper.py: Bitwarden CLI wrapper (password gen, item CRUD,
  TOTP, session management)
- Dockerfile: Playwright v1.52.0 + bw CLI + Python deps
- agents.yaml.example: manifest template for Q3/Q4 agents
- TSYSGroupAIOS framework adopted (hooks, rules engine, Makefile)

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

questions-v1.md

@@ -0,0 +1,18 @@
+# questions-v1.md
+
+## Q1: Cloudron invite page selectors
+The Playwright automation needs to interact with the Cloudron invite acceptance page (password fields, 2FA enrollment). The exact CSS selectors will need verification against the live Cloudron UI. **Are you able to provide a screenshot of the invite acceptance flow, or should the code use generic selectors and we iterate?**
+
+## Q2: Discourse API key creation
+Regular (non-admin) Discourse users may not be able to self-generate API keys. Options:
+1. Admin pre-creates API keys for each agent (via Discourse admin panel)
+2. The provisioning script uses an admin key to create per-user API keys
+3. Agents use the admin key directly (not ideal for per-identity attribution)
+
+**Which approach do you prefer?**
+
+## Q3: Gitea org membership
+After SSO login, the agent needs to be added to Gitea orgs (KNEL, TechnicalOperations, etc.). Can this be automated via Gitea API (using an admin token), or should org membership be pre-configured via the Gitea web UI before provisioning?
+
+## Q4: Bitwarden collection creation
+Does the BW "COO" account need collections pre-created (vp-techops, vp-secops, etc.), or should the provisioning script create them if they don't exist?