feat: rename rails/ to tools/ and add service tool suites

Rename the `rails/` directory to `tools/` for agent discoverability —
agents frequently failed to locate helper scripts due to the non-intuitive
directory name. Add backward-compat symlink `rails/ → tools/`.

New tool suites:
- Authentik: auth-token, user-list, user-create, group-list, app-list,
  flow-list, admin-status (8 scripts)
- Coolify: team-list, project-list, service-list, service-status, deploy,
  env-set (7 scripts)
- Woodpecker: pipeline-list, pipeline-status, pipeline-trigger (3 stubs)
- GLPI: session-init, computer-list, ticket-list, ticket-create, user-list
  (6 scripts)
- Health: stack-health.sh — stack-wide connectivity check

Infrastructure:
- Shared credential loader at tools/_lib/credentials.sh
- install.sh creates symlink + chmod on tool scripts
- All ~253 rails/ path references updated across 68+ files

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/orchestrator-matrix/adapters/README.md

@@ -0,0 +1,52 @@
+# Adapter Contract
+
+Runtime adapters translate task commands into concrete worker invocations.
+
+## Minimal Contract
+
+Each task should define either:
+
+1. `command` directly in `tasks.json`, or
+2. controller-level `worker.command_template` in `.mosaic/orchestrator/config.json`
+
+`command_template` may use:
+
+- `{task_id}`
+- `{task_title}`
+- `{task_file}`
+
+## Examples
+
+Codex:
+
+```json
+{
+  "worker": {
+    "command_template": "codex \"run task {task_id}: {task_title}\""
+  }
+}
+```
+
+Claude:
+
+```json
+{
+  "worker": {
+    "command_template": "claude -p \"Execute task {task_id}: {task_title}\""
+  }
+}
+```
+
+OpenCode:
+
+```json
+{
+  "worker": {
+    "command_template": "opencode \"execute task {task_id}: {task_title}\""
+  }
+}
+```
+
+## Recommendation
+
+Prefer explicit per-task `command` for deterministic execution and auditability.