feat: rename rails/ to tools/ and add service tool suites

Rename the `rails/` directory to `tools/` for agent discoverability —
agents frequently failed to locate helper scripts due to the non-intuitive
directory name. Add backward-compat symlink `rails/ → tools/`.

New tool suites:
- Authentik: auth-token, user-list, user-create, group-list, app-list,
  flow-list, admin-status (8 scripts)
- Coolify: team-list, project-list, service-list, service-status, deploy,
  env-set (7 scripts)
- Woodpecker: pipeline-list, pipeline-status, pipeline-trigger (3 stubs)
- GLPI: session-init, computer-list, ticket-list, ticket-create, user-list
  (6 scripts)
- Health: stack-health.sh — stack-wide connectivity check

Infrastructure:
- Shared credential loader at tools/_lib/credentials.sh
- install.sh creates symlink + chmod on tool scripts
- All ~253 rails/ path references updated across 68+ files

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/git/pr-diff.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# pr-diff.sh - Get the diff for a pull request on GitHub or Gitea
+# Usage: pr-diff.sh -n <pr_number> [-o <output_file>]
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/detect-platform.sh"
+
+# Parse arguments
+PR_NUMBER=""
+OUTPUT_FILE=""
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -n|--number)
+            PR_NUMBER="$2"
+            shift 2
+            ;;
+        -o|--output)
+            OUTPUT_FILE="$2"
+            shift 2
+            ;;
+        -h|--help)
+            echo "Usage: pr-diff.sh -n <pr_number> [-o <output_file>]"
+            echo ""
+            echo "Options:"
+            echo "  -n, --number   PR number (required)"
+            echo "  -o, --output   Output file (optional, prints to stdout if omitted)"
+            echo "  -h, --help     Show this help"
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1"
+            exit 1
+            ;;
+    esac
+done
+
+if [[ -z "$PR_NUMBER" ]]; then
+    echo "Error: PR number is required (-n)" >&2
+    exit 1
+fi
+
+detect_platform > /dev/null
+
+if [[ "$PLATFORM" == "github" ]]; then
+    if [[ -n "$OUTPUT_FILE" ]]; then
+        gh pr diff "$PR_NUMBER" > "$OUTPUT_FILE"
+    else
+        gh pr diff "$PR_NUMBER"
+    fi
+elif [[ "$PLATFORM" == "gitea" ]]; then
+    # tea doesn't have a direct diff command — use the API
+    OWNER=$(get_repo_owner)
+    REPO=$(get_repo_name)
+    REMOTE_URL=$(git remote get-url origin 2>/dev/null)
+
+    # Extract host from remote URL
+    if [[ "$REMOTE_URL" == https://* ]]; then
+        HOST=$(echo "$REMOTE_URL" | sed -E 's|https://([^/]+)/.*|\1|')
+    elif [[ "$REMOTE_URL" == git@* ]]; then
+        HOST=$(echo "$REMOTE_URL" | sed -E 's|git@([^:]+):.*|\1|')
+    else
+        echo "Error: Cannot determine host from remote URL" >&2
+        exit 1
+    fi
+
+    DIFF_URL="https://${HOST}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}.diff"
+
+    # Use tea's auth token if available
+    TEA_TOKEN=$(tea login list 2>/dev/null | grep "$HOST" | awk '{print $NF}' || true)
+
+    if [[ -n "$TEA_TOKEN" ]]; then
+        DIFF_CONTENT=$(curl -sS -H "Authorization: token $TEA_TOKEN" "$DIFF_URL")
+    else
+        DIFF_CONTENT=$(curl -sS "$DIFF_URL")
+    fi
+
+    if [[ -n "$OUTPUT_FILE" ]]; then
+        echo "$DIFF_CONTENT" > "$OUTPUT_FILE"
+    else
+        echo "$DIFF_CONTENT"
+    fi
+else
+    echo "Error: Unknown platform" >&2
+    exit 1
+fi