agent-credential-broker: fork of vaultwarden-agent-broker + OpenBao backend

Mechanical rename (package agent_credential_broker; entry points
agent-broker{,-mcp,-plugin}; env AGENT_BROKER_*; paths agent-broker;
agent-browser credential provider 'broker'; MCP server name agent-broker).

New backend 'openbao': stdlib-only HTTP client for OpenBao/Vault KV v2
(approle login or token file/env; metadata-only ref index; lazy re-login
on 401/403; token renewal). bitwarden-cli backend kept as transition.

systemd/agent-broker.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Agent credential broker (unix-socket daemon)
+
+[Service]
+Type=simple
+# The wrapper resolves the package via PYTHONPATH; %h keeps it portable.
+ExecStart=%h/.local/bin/agent-broker daemon
+Restart=on-failure
+RestartSec=2s
+# bw is located via config bw_path (preferred) or PATH; the child's PATH
+# is rebuilt by the backend, so only the daemon's own tools matter here.
+Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
+Environment=AGENT_BROKER_CONFIG=%h/.paginica/mcp/agent-broker/config.json
+
+[Install]
+WantedBy=default.target