cache bitwarden secrets in env vars to skip unlock on repeated runs

scripts/remove-app.sh

@@ -28,21 +28,28 @@ if ! command -v bw &>/dev/null; then
     exit 1
 fi
 
-# --- Get Gitea API token from Bitwarden ---
+# --- Get secrets (cached in env vars, or fetch from Bitwarden) ---
 
-if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
-    echo "Log in to Bitwarden:"
-    bw login
+if [ -n "${HANTIM_GITEA_TOKEN:-}" ]; then
+    echo "Using cached secrets from environment."
+    GITEA_TOKEN="$HANTIM_GITEA_TOKEN"
+else
+    if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
+        echo "Log in to Bitwarden:"
+        bw login
+    fi
+
+    if bw status 2>/dev/null | grep -q '"status":"locked"'; then
+        BW_SESSION=$(bw unlock --raw)
+        export BW_SESSION
+    fi
+
+    bw sync --session "${BW_SESSION:-}"
+    GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
+
+    export HANTIM_GITEA_TOKEN="$GITEA_TOKEN"
 fi
 
-if bw status 2>/dev/null | grep -q '"status":"locked"'; then
-    BW_SESSION=$(bw unlock --raw)
-    export BW_SESSION
-fi
-
-bw sync --session "${BW_SESSION:-}"
-GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
-
 # --- Delete Gitea repo ---
 
 echo "==> Deleting Gitea repo $GITEA_ORG/$APP..."