fix: critical bugs in agent identity provisioning [#442]

Email domain bug (would have caused all provisioning to fail):
- Cloudron email default was tsys-cloudron.knel.net (the dashboard host)
  instead of turnsys.com (the actual identity domain). Fixed in 3 places.
- Added explicit cloudron_email field to all agents in agents.yaml.example.

Other fixes:
- STATE_DIR.mkdir() moved from module level to main() so --dry-run and
  --help work outside the container.
- IndexError guard: password_inputs[0] crashes if zero fields found.
- State file save moved to finally block so partial results survive
  provisioning failures.
- Exception in provision_agent no longer re-raised (was preventing state
  file write and summary reporting).
- BW item_exists no longer swallows network/session errors as 'not found'
  (was causing duplicate credential creation).
- Redundant -u flag in bw generate (-uluns → -ulns).
- Dockerfile: npx install with || true → npm install -g (silent failure
  would cause runtime 'bw: command not found').
- Added .dockerignore to prevent .env/agents.yaml/state from entering image.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

bw-helper.py

@@ -74,7 +74,7 @@ class BitwardenHelper:
 
     def generate_password(self, length: int = 32) -> str:
         """Generate a strong password."""
-        return self._run_bw(["generate", "-uluns", "--length", str(length)])
+        return self._run_bw(["generate", "-ulns", "--length", str(length)])
 
     def get_totp(self, item_name: str) -> str:
         """Get the current TOTP code for a Bitwarden item."""
@@ -172,8 +172,13 @@ class BitwardenHelper:
         try:
             self._run_bw(["get", "item", name])
             return True
-        except RuntimeError:
-            return False
+        except RuntimeError as e:
+            # Distinguish "not found" (expected) from real errors (network, session expired).
+            err_msg = str(e).lower()
+            if "not found" in err_msg or "no item" in err_msg:
+                return False
+            # Real error — re-raise so we don't silently create duplicates.
+            raise
 
     def get_item_password(self, name: str) -> str:
         """Get the password field from a Bitwarden item."""