The bitwarden-cli Deployment's startup script never set BW_SESSION when
running without API-key creds (empty password branch / bw unlock --check
only), so bw serve started unauthenticated and every ExternalSecret across
all namespaces failed with HTTP 400 / 'Not found'. Wrap login in a function,
export the session, warm the cache once, and re-login every 5m in the
background loop so the session token never lapses.
The notepad container's entrypoint runs chown -R www-data:www-data
on /var/www/html/_tmp, which fails because the NFS export on nebula
uses all_squash with anonuid=65534. Override the command to skip
chown and just create the dir + copy .htaccess before starting apache.
