Add agent-blind Bitwarden recovery

[turinglabsorg]

Summary

• add hush generate for CSPRNG-backed credentials that are encrypted immediately and never printed
• add hush bitwarden unlock to log in or unlock from a stored master password and persist the fresh session encrypted
• protect existing generated secrets from accidental replacement unless --force is explicit
• document the agent-owned Bitwarden recovery flow and bump the release to v0.4.0

Verification

• cargo fmt --check
• cargo test --locked — 60 tests passed
• cargo clippy --locked -- -D warnings
• skill validation passed
• live Bitwarden login, forced re-lock, second unlock, and session-backed vault access passed without exposing credentials