feat(test): provision erp-sandbox via Playwright (REST API + write-scoped ai_agent_sandbox user)

Extend the Deno + Playwright UI-automation POC to provision the erp-sandbox
Dolibarr for the AI agent:

- moduleSetup.ts: add enableApiModule(ctx) — toggles the REST API / Web services
  module on /admin/modules.php (kanban). Resilient: tries the fr_FR card label
  "API/Web services REST (serveur)" first, falls back to a /API.*REST|REST.*API/i
  title match if the exact label is absent.
- userSetup.ts (new): createUser (returns the new numeric id), assignRights
  (clicks each addrights link on /user/perms.php, idempotent), generateApiKey
  (triggers Dolibarr's generate control on the user card and reads the value back).
- provisionSandbox.ts (new entrypoint, main.ts untouched): login → enable API →
  create ai_agent_sandbox (non-admin) → grant write rights → generate API key,
  then write the key to test/.ai_agent_sandbox.key (gitignored) instead of
  printing it.
- .gitignore (new), .env.example + README.md: sandbox vars, the
  deno run --allow-all provisionSandbox.ts command, and kubectl one-liners to
  pull DOLI_ADMIN_PASSWORD (secretkv) / DOLI_DB_PASSWORD (vso-db-credentials)
  from the erp-sandbox namespace.

Why UI not SQL: API keys are encrypted with the instance's DOLI_INSTANCE_UNIQUE_ID,
so the key must be generated by the sandbox itself, not INSERTed raw.

deno check passes for provisionSandbox.ts and scripts/admin/userSetup.ts.
NOT run end-to-end: the sandbox Dolibarr is not installed yet (empty DB / fresh
install wizard), so the selectors are best-effort Dolibarr 22 conventions and
must be confirmed on the first real run.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test/.env.example

@@ -1,5 +1,19 @@
+# --- Production / default target (main.ts) ---
 DOLIBARR_ADDRESS=https://erp.arcodange.lab
 DOLI_DB_PASSWORD=
 DOLI_ADMIN_LOGIN=admin
 DOLI_ADMIN_PASSWORD=""
-ROOT_FOLDER=$HOME/erp
+ROOT_FOLDER=$HOME/erp
+
+# --- Sandbox provisioning (provisionSandbox.ts) ---
+# Point at the sandbox and reuse the DOLI_ADMIN_* vars above for the admin login.
+# Populate from the erp-sandbox namespace secrets (see "Provision the sandbox" in
+# README.md):
+#   DOLI_ADMIN_PASSWORD  <- secret `secretkv`        (-n erp-sandbox)
+#   DOLI_DB_PASSWORD     <- secret `vso-db-credentials` (-n erp-sandbox)
+# Override DOLIBARR_ADDRESS to the sandbox when running provisionSandbox.ts:
+#   DOLIBARR_ADDRESS=https://erp-sandbox.arcodange.lab
+#
+# Optional: fix the new user's password (otherwise one is generated and only the
+# API key is emitted). Never commit a real value here.
+# AI_AGENT_SANDBOX_PASSWORD=""