The bitwarden-cli Deployment's startup script never set BW_SESSION when
running without API-key creds (empty password branch / bw unlock --check
only), so bw serve started unauthenticated and every ExternalSecret across
all namespaces failed with HTTP 400 / 'Not found'. Wrap login in a function,
export the session, warm the cache once, and re-login every 5m in the
background loop so the session token never lapses.
