fix: resolve BW state sync issue -- add sync() to login lifecycle

The provisioner's BitwardenHelper.login() was missing the critical
`bw sync` step that the host wrapper includes. Without syncing after
login, the container's local vault cache was empty/stale, causing items
to vanish between container runs. Added sync() call at end of login()
and before list_items().

Also fixed container UID/GID to match host user (1002:1002) for proper
bind-mount access, and added source-code volume mounts for fast iteration.

Verified with 5-phase cross-container persistence test (create in
container A, verify in fresh container B, update in C, confirm in D).

bw_helper.py

@@ -110,6 +110,18 @@ class BitwardenHelper:
         if not self.session:
             raise RuntimeError("BW unlock failed -- no session token returned")
 
+        self.sync()
+
+    def sync(self) -> None:
+        """Sync the local vault cache with the server.
+
+        Must be called after login and before any read to guarantee
+        the local cache reflects the latest server state. Without this,
+        items created by other clients (e.g. the host bw wrapper) will
+        not appear in list/search results.
+        """
+        self._run_bw(["sync"])
+
     def generate_password(self, length: int = 32) -> str:
         """Generate a strong password."""
         return self._run_bw(["generate", "-ulns", "--length", str(length)])
@@ -280,6 +292,7 @@ class BitwardenHelper:
 
     def list_items(self) -> list[dict]:
         """List all items in the vault."""
+        self.sync()
         output = self._run_bw(["list", "items"])
         return json.loads(output)