feat: add bwp/bwc/bwu — rbw + fzf + wl-copy vault scripts

bwp: select entry → copy password to clipboard
bwc: select entry → copy TOTP/2FA code to clipboard
bwu: select entry → copy username/email to clipboard

Single writeShellApplication dispatched by $0, three symlinks
(bwp/bwc/bwu) installed via home.packages.

modules/home-manager/bitwarden-cli/default.nix

@@ -3,9 +3,32 @@
   config,
   pkgs,
   ...
-}:
-{
+}: let
+  bw = pkgs.writeShellApplication {
+    name = "bw";
+    runtimeInputs = with pkgs; [ rbw fzf wl-clipboard libnotify ];
+    text = ''
+      set -euo pipefail
+      cmd="$(basename "$0")"
 
+      entry="$(rbw list --fields=id,name,user --format=tsv \
+        | fzf --with-nth=2.. --delimiter=$'\t')"
+      [ -z "$entry" ] && exit 0
+
+      id="$(printf '%s' "$entry" | cut -f1)"
+
+      case "$cmd" in
+        bwc) val="$(rbw code "$id")"                          ;;
+        bwu) val="$(rbw get --field username "$id")"          ;;
+        bwp) val="$(rbw get "$id")"                           ;;
+        *)   exit 1                                            ;;
+      esac
+
+      printf '%s' "$val" | wl-copy
+      notify-send -t 1200 "bw: copied $cmd"
+    '';
+  };
+in {
   options.custom = {
     bitwarden.enable = lib.mkEnableOption "enable bitwarden - CLI password manager";
   };
@@ -20,5 +43,16 @@
         base_url = "https://pass.joaoporta.com";
       };
     };
+
+    home.packages =
+      let mkBin = name:
+        pkgs.symlinkJoin {
+          inherit name;
+          paths = [ bw ];
+          nativeBuildInputs = [ pkgs.makeWrapper ];
+          postBuild = "ln -sf ${bw}/bin/bw $out/bin/${name}";
+        };
+      in
+        builtins.map mkBin [ "bwp" "bwc" "bwu" ];
   };
 }