Adds a bws-CLI build stage to the Dockerfile and a docker-entrypoint.sh
that runs `bws run -- node server.js` when BWS_ACCESS_TOKEN is set,
falling back to a plain `node server.js` start when it's not. Lets AWS
Route 53 credentials (and any future BWS-managed secret) reach the
container without ever being written to the committed .env file.
Fixed during phase 24 verification:
- The bws CLI config only set state_dir; bws 2.x requires server_base
(or server_identity) even for the default Bitwarden cloud instance,
which crash-looped the container on every start. Added
server_base = "https://vault.bitwarden.com".
- docker-compose.yml's app.environment block re-declared
BWS_ACCESS_TOKEN/BWS_PROJECT_ID as ${VAR:-} substitutions, which
resolve against the root .env (not .env.local) and silently
overrode the real token with an empty string. Removed the redundant
re-declaration — env_file: .env.local already injects them.
Verified live: pulse-app rebuilt and restarted with both fixes,
AWS credentials confirmed reaching the Node process via BWS injection.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Renamed project from PSA-Utils to Pulse
- Moved all app files from autotask-app/ to root
- Updated package.json name to 'pulse'
- Updated Docker container names to pulse-app and pulse-redis
- Updated Docker network name to pulse-network
