migrate bootstrap.sh from bw to bws, update docs

scripts/bootstrap.sh

@@ -10,8 +10,16 @@ set -euo pipefail
 #   2. git clone https://git.timothykim.net/hantim/hantim-server.git /opt/hantim
 #   3. bash /opt/hantim/scripts/bootstrap.sh
 #
+# Prerequisites:
+#   - Bitwarden Secrets Manager access token for the hantim-server machine account
 
 REPO_DIR="/opt/hantim"
+BWS_TOKEN_FILE="/etc/bws-token"
+BWS_VERSION="2.0.0"
+
+# Secret IDs (Bitwarden Secrets Manager)
+SECRET_REGISTRY_TOKEN="43f4a77d-7bb4-49ad-8044-b411016c5c6e"
+SECRET_DEPLOY_PUBKEY="945760dd-90e2-46e5-98ad-b411016e3f3b"
 
 # --- Prerequisites ---
 
@@ -32,29 +40,41 @@ echo "==> Upgrading system packages..."
 dnf upgrade -y
 
 echo "==> Installing dependencies..."
-dnf install -y jq epel-release
+dnf install -y jq epel-release unzip
 dnf install -y certbot
-dnf module reset -y nodejs
-dnf module install -y nodejs:20/common
 
-BW_CLI="$(npm config get prefix)/bin/bw"
-if [ ! -x "$BW_CLI" ]; then
-    echo "==> Installing Bitwarden CLI..."
-    npm install -g @bitwarden/cli
+# --- Install bws CLI ---
+
+if ! command -v bws &>/dev/null; then
+    echo "==> Installing Bitwarden Secrets Manager CLI..."
+    curl -sL "https://github.com/bitwarden/sdk-sm/releases/download/bws-v${BWS_VERSION}/bws-x86_64-unknown-linux-gnu-${BWS_VERSION}.zip" -o /tmp/bws.zip
+    unzip -o /tmp/bws.zip -d /usr/local/bin
+    chmod +x /usr/local/bin/bws
+    rm /tmp/bws.zip
 fi
 
-# --- Fetch secrets from Bitwarden ---
+# --- Set up access token ---
 
-echo "==> Fetching secrets from Bitwarden..."
-echo "    Log in to Bitwarden when prompted."
-if "$BW_CLI" status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
-    "$BW_CLI" login
+if [ ! -f "$BWS_TOKEN_FILE" ]; then
+    echo "==> Bitwarden Secrets Manager access token required."
+    echo "    Generate one for the hantim-server machine account at:"
+    echo "    https://vault.bitwarden.com/#/sm/machine-accounts"
+    read -rp "    Paste access token: " BWS_TOKEN
+    if [ -z "$BWS_TOKEN" ]; then
+        echo "ERROR: Access token cannot be empty."
+        exit 1
+    fi
+    echo "$BWS_TOKEN" > "$BWS_TOKEN_FILE"
+    chmod 600 "$BWS_TOKEN_FILE"
 fi
-BW_SESSION=$("$BW_CLI" unlock --raw)
-"$BW_CLI" sync --session "$BW_SESSION"
-REGISTRY_TOKEN=$("$BW_CLI" get notes hantim-ci-registry-push --session "$BW_SESSION")
-DEPLOY_PUBKEY=$("$BW_CLI" get item hantim-server-deploy --session "$BW_SESSION" | jq -r '.sshKey.publicKey')
-"$BW_CLI" lock
+export BWS_ACCESS_TOKEN
+BWS_ACCESS_TOKEN=$(cat "$BWS_TOKEN_FILE")
+
+# --- Fetch secrets ---
+
+echo "==> Fetching secrets from Bitwarden Secrets Manager..."
+REGISTRY_TOKEN=$(bws secret get "$SECRET_REGISTRY_TOKEN" | jq -r .value)
+DEPLOY_PUBKEY=$(bws secret get "$SECRET_DEPLOY_PUBKEY" | jq -r .value)
 
 # --- Install Docker ---