feat: full app provisioning for all COO agents + race-hardened BW helper

App credentials now flow for every agent: shared handle_oidc_interaction
helper fills the per-app OIDC login form/TOTP/consent (the panel session
is not shared across app clients -- each may demand fresh credentials),
and the Discourse signup clears the prefilled username field before
typing (prefill+typed concatenation exceeded the 20-char cap and failed
validation silently).

BW helper hardened against the sync races observed across concurrent
containers: get_item_id re-syncs stale caches, create/edit retry with
backoff and post-write sync. This class of failure was mine -- the
login-path fix from session 3 left read paths on stale caches.

Final validated matrix (validate-all-logins.py, fresh-context logins
plus live API checks): 9/10 fully green; vp-compliance blocked on a
corrupt stored password (Cloudron admin reset needed). Redmine access
still Cloudron-denied for vp-secops, svp-knel, vp-techcompliance,
vp-facilities ("You do not have access" at the OIDC interaction).

docker-compose.yml

@@ -26,3 +26,6 @@ services:
       - ./validate-all-logins.py:/app/validate-all-logins.py:ro
       - ./diagnose-vp-compliance.py:/app/diagnose-vp-compliance.py:ro
       - ./validate-coo.py:/app/validate-coo.py:ro
+      - ./diagnose-sso-chain.py:/app/diagnose-sso-chain.py:ro
+      - ./probe-redmine-access.py:/app/probe-redmine-access.py:ro
+      - ./probe-discourse-signup.py:/app/probe-discourse-signup.py:ro