Add collection management commands and non-interactive unlock

[FluffyDiscord]

Summary

This adds organization collection management to rbw, plus a non-interactive unlock path so the agent can run headless (servers, cron) without a pinentry prompt.

New commands

Command	Description
list-collections (alias lsc)	List all collections in the organization (--raw for JSON)
create-collection <name> --org-id <id>	Create a new collection in an organization
rename-collection <id> --organizationid <id> <name>	Rename an organization collection
delete-collection <collection-id> --org-id <id>	Delete an organization collection
edit-collections <entry-id> <collections>	Set which collections an entry belongs to (Base64-encoded JSON array of collection IDs)
propagate-collection-permissions [--org-id <id>] [--apply] [-v]	Grant members access to nested collections: the member's topmost held collection becomes can edit, every nested descendant becomes can manage

propagate-collection-permissions

Collections in Vaultwarden/Bitwarden are flat names with / as a path separator (e.g. Projects/foo, Projects/foo/Dev). This command walks each member's grants and, for the topmost collection they hold, gives them can edit, then can manage on every collection nested beneath it.

• Dry-run by default — prints the plan; --apply is required to write. --apply is idempotent.
• Performance-conscious: 2 HTTP GETs regardless of org size (members + collections/details, which batches every collection's users[]), one PUT per changed collection, and zero writes in steady state, so it's safe to run daily/on-demand.
• Skips Owners and Admins, accessAll members, and unconfirmed invitations; only confirmed Users/Managers are eligible.

Non-interactive unlock (BW_ACCOUNT_PASSWORD)

The agent now reads the master password from the BW_ACCOUNT_PASSWORD environment variable before falling back to pinentry, for both login and unlock. This lets rbw run on a headless server or from cron — set the env var once and the agent unlocks/logs in without prompting. When the variable is unset, behaviour is unchanged (pinentry as before), so it's fully opt-in.

Implementation notes

• New API methods (src/api.rs): org_users, collections_details, set_collection_users, plus collection create/rename/delete, following the existing api.rs → actions.rs → commands.rs layering.
• Collection name decryption reuses the agent's existing decrypt IPC; no crypto is reimplemented.
• set_collection_users merges into each collection's existing users[] (the PUT is a full replace upstream), so other members' and groups' access is preserved.

Commits

• Agent - support non-interactive unlock via BW_ACCOUNT_PASSWORD env
• Collections - add management commands
• Collections - add delete command
• Collections - add permission propagation