Bring the daemon's provisioning path to parity with (and ahead of) the
clawdie-vault-fetch shell helper (#69):
- BW_SERVER: tolerate 'logout required/already configured' ONLY when the
already-configured server matches the expected endpoint; else fail closed
(new VaultError::ServerMismatch). Fixes repeat-provision failure AND prevents
a stale login fetching from the wrong Bitwarden host.
- Serialize the whole login→unlock→fetch→lock via a process-wide async Mutex —
bw keeps process-global state, so concurrent provisions could race (closes#95).
- Validate secure-note KEYs with validate_key too (login items were already
validated; notes wrote raw KEY=VALUE).
Tests: cargo build/test -p colibri-vault (7 pass), cargo fmt --check clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
