feat: rename rails/ to tools/ and add service tool suites

Rename the `rails/` directory to `tools/` for agent discoverability —
agents frequently failed to locate helper scripts due to the non-intuitive
directory name. Add backward-compat symlink `rails/ → tools/`.

New tool suites:
- Authentik: auth-token, user-list, user-create, group-list, app-list,
  flow-list, admin-status (8 scripts)
- Coolify: team-list, project-list, service-list, service-status, deploy,
  env-set (7 scripts)
- Woodpecker: pipeline-list, pipeline-status, pipeline-trigger (3 stubs)
- GLPI: session-init, computer-list, ticket-list, ticket-create, user-list
  (6 scripts)
- Health: stack-health.sh — stack-wide connectivity check

Infrastructure:
- Shared credential loader at tools/_lib/credentials.sh
- install.sh creates symlink + chmod on tool scripts
- All ~253 rails/ path references updated across 68+ files

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

guides/orchestrator.md

@@ -272,7 +272,7 @@ Provider options:
 1. Gitea (preferred when available) via Mosaic helper:
 
 ```bash
-~/.config/mosaic/rails/git/issue-create.sh \
+~/.config/mosaic/tools/git/issue-create.sh \
   -t "Phase 1: Critical Security Fixes" \
   -b "$(cat <<'EOF'
 ## Findings
@@ -412,15 +412,15 @@ git push
     and checklist completed (`~/.config/mosaic/templates/docs/DOCUMENTATION-CHECKLIST.md`) when applicable.
 13. **PR + CI + Issue Closure Gate** (HARD RULE for source-code tasks):
     - Before merging, run queue guard:
-      `~/.config/mosaic/rails/git/ci-queue-wait.sh --purpose merge -B main`
+      `~/.config/mosaic/tools/git/ci-queue-wait.sh --purpose merge -B main`
     - Ensure PR exists for the task branch (create/update via wrappers if needed):
-      `~/.config/mosaic/rails/git/pr-create.sh ... -B main`
+      `~/.config/mosaic/tools/git/pr-create.sh ... -B main`
     - Merge via wrapper:
-      `~/.config/mosaic/rails/git/pr-merge.sh -n {PR_NUMBER} -m squash`
+      `~/.config/mosaic/tools/git/pr-merge.sh -n {PR_NUMBER} -m squash`
     - Wait for terminal CI status:
-      `~/.config/mosaic/rails/git/pr-ci-wait.sh -n {PR_NUMBER}`
+      `~/.config/mosaic/tools/git/pr-ci-wait.sh -n {PR_NUMBER}`
     - Close linked issue after merge + green CI:
-      `~/.config/mosaic/rails/git/issue-close.sh -i {ISSUE_NUMBER}`
+      `~/.config/mosaic/tools/git/issue-close.sh -i {ISSUE_NUMBER}`
     - If any wrapper command fails, mark task `blocked`, record the exact failed wrapper command, report blocker, and STOP.
     - Do NOT stop at "PR created" or "PR merged pending CI".
     - Do NOT claim completion before CI is green and issue/internal ref is closed.
@@ -463,10 +463,10 @@ Run review when the worker's result includes code changes (commits). Skip for ta
 cd {project_path}
 
 # Code quality review
-~/.config/mosaic/rails/codex/codex-code-review.sh -b {base_branch} -o /tmp/review-{task_id}.json
+~/.config/mosaic/tools/codex/codex-code-review.sh -b {base_branch} -o /tmp/review-{task_id}.json
 
 # Security review
-~/.config/mosaic/rails/codex/codex-security-review.sh -b {base_branch} -o /tmp/security-{task_id}.json
+~/.config/mosaic/tools/codex/codex-security-review.sh -b {base_branch} -o /tmp/security-{task_id}.json
 ```
 
 ### Step 2: Parse Review Results
@@ -599,19 +599,19 @@ Construct this from the task row and pass to worker via Task tool:
 7. If task is bug fix/security/auth/critical business logic, apply REQUIRED TDD discipline per `~/.config/mosaic/guides/QA-TESTING.md`.
 8. If gates or required situational tests fail: Fix and retry. Do NOT report success with failures.
 9. Commit: `git commit -m "fix({finding_id}): brief description"`
-10. Before push, run queue guard: `~/.config/mosaic/rails/git/ci-queue-wait.sh --purpose push -B main`
+10. Before push, run queue guard: `~/.config/mosaic/tools/git/ci-queue-wait.sh --purpose push -B main`
 11. Push: `git push origin {branch}`
 12. Report result as JSON (see format below)
 
 ## Git Scripts
 
 For issue/PR/milestone operations, use scripts (NOT raw tea/gh):
-- `~/.config/mosaic/rails/git/issue-view.sh -i {N}`
-- `~/.config/mosaic/rails/git/pr-create.sh -t "Title" -b "Desc" -B main`
-- `~/.config/mosaic/rails/git/ci-queue-wait.sh --purpose push|merge -B main`
-- `~/.config/mosaic/rails/git/pr-merge.sh -n {PR_NUMBER} -m squash`
-- `~/.config/mosaic/rails/git/pr-ci-wait.sh -n {PR_NUMBER}`
-- `~/.config/mosaic/rails/git/issue-close.sh -i {N}`
+- `~/.config/mosaic/tools/git/issue-view.sh -i {N}`
+- `~/.config/mosaic/tools/git/pr-create.sh -t "Title" -b "Desc" -B main`
+- `~/.config/mosaic/tools/git/ci-queue-wait.sh --purpose push|merge -B main`
+- `~/.config/mosaic/tools/git/pr-merge.sh -n {PR_NUMBER} -m squash`
+- `~/.config/mosaic/tools/git/pr-ci-wait.sh -n {PR_NUMBER}`
+- `~/.config/mosaic/tools/git/issue-close.sh -i {N}`
 
 Standard git commands (pull, commit, push, checkout) are fine.
 
@@ -1035,7 +1035,7 @@ When all tasks in `docs/TASKS.md` are `done` (or triaged as `deferred`), you MUS
 5. **Close milestone in provider**:
    - Gitea/GitHub:
    ```bash
-   ~/.config/mosaic/rails/git/milestone-close.sh -t "{milestone-name}"
+   ~/.config/mosaic/tools/git/milestone-close.sh -t "{milestone-name}"
    ```
    - GitLab: close milestone via provider workflow (CLI or web UI).
    If provider tooling is unavailable, record milestone closure status in `docs/TASKS.md` notes.