feat(infra): add Bitwarden Secrets Manager injection for container secrets

Adds a bws-CLI build stage to the Dockerfile and a docker-entrypoint.sh
that runs `bws run -- node server.js` when BWS_ACCESS_TOKEN is set,
falling back to a plain `node server.js` start when it's not. Lets AWS
Route 53 credentials (and any future BWS-managed secret) reach the
container without ever being written to the committed .env file.

Fixed during phase 24 verification:
- The bws CLI config only set state_dir; bws 2.x requires server_base
  (or server_identity) even for the default Bitwarden cloud instance,
  which crash-looped the container on every start. Added
  server_base = "https://vault.bitwarden.com".
- docker-compose.yml's app.environment block re-declared
  BWS_ACCESS_TOKEN/BWS_PROJECT_ID as ${VAR:-} substitutions, which
  resolve against the root .env (not .env.local) and silently
  overrode the real token with an empty string. Removed the redundant
  re-declaration — env_file: .env.local already injects them.

Verified live: pulse-app rebuilt and restarted with both fixes,
AWS credentials confirmed reaching the Node process via BWS injection.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -142,6 +142,13 @@ services:
       POSTGRES_USER: ${POSTGRES_USER:-pulse_user}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-your_secure_password_here_change_in_production}
       DATABASE_URL: postgresql://${POSTGRES_USER:-pulse_user}:${POSTGRES_PASSWORD:-your_secure_password_here_change_in_production}@postgres:5432/${POSTGRES_DB:-pulse_autotask}
+
+      # Bitwarden Secrets Manager (optional) — deliberately NOT re-declared here.
+      # env_file: .env.local already injects BWS_ACCESS_TOKEN/BWS_PROJECT_ID directly.
+      # Re-declaring them as ${VAR:-} substitutions resolves against the root .env /
+      # shell env (not .env.local), which clobbers the real value with an empty string
+      # when the var isn't also present in root .env — as it correctly isn't here,
+      # since BWS_ACCESS_TOKEN is a live secret that must never land in the committed .env.
     depends_on:
       redis:
         condition: service_healthy