bugs: vendored bugs.sulkta.com SDK + /bugs page

Wires cauldron up to the unified Sulkta bug tracker per
memory/spec-bugs-unified-sdk.md (Phases 1-7 shipped 2026-05-02).

What's included:
- Vendored bugs-sulkta-py at cauldron/vendor/bugs_sulkta (4 stdlib-only
  files copied verbatim from Sulkta-Coop/bugs-sulkta-py main). Same
  vendoring approach as TC's backend/api/bugs_sulkta — Docker BuildKit
  can't reach LAN Gitea, so the package ships in the source tree.
- BUGS_API_KEY + BUGS_BASE_URL env (config.py). Empty key = page renders
  "not configured" placeholder; POSTs return 503. Lets dev runs skip
  provisioning a key.
- New routes (server.py): GET /bugs (page), GET /api/bugs (list),
  POST /api/bugs (create). All session-auth. Per-service key returns
  every cauldron report; we filter client-side by user_email so each
  household member sees only their own. Admins get a "show all" toggle.
- bugs.html template in mythic-witch style: subject + message + kind
  + severity form, filed-reports list with status glyphs (📂 open
  🔨 in-progress ✅ resolved ⛔ wontfix), relative timestamps.
- _base.html nav: 🐞 bugs link between discover and me.
- Server-side auto-fill: user_email/user_name from session, page_url
  from referrer, user_agent from request headers.

Defaults are dev-safe — no env change required for the LAN soak. When
Cobb mints the key with:
  docker exec bugs-sulkta bugs-sulkta-cli keys create \
    --service=cauldron --scopes=read,write,update \
    --description="cauldron prod"
…drop it into BUGS_API_KEY and the page lights up.

.env.example

@@ -62,3 +62,11 @@ CAULDRON_BEHIND_TLS=false
 # X-Forwarded-* from a peer outside this list gets dropped before
 # ProxyFix sees it.
 CAULDRON_TRUSTED_PROXIES=
+
+# bugs.sulkta.com integration. Per-service key minted via:
+#   docker exec bugs-sulkta bugs-sulkta-cli keys create --service=cauldron \
+#     --scopes=read,write,update --description="cauldron prod"
+# Empty = bugs page renders a "not configured" placeholder; POSTs return 503.
+BUGS_API_KEY=
+# Override only for staging / on-prem bugs deployments. Default is fine.
+BUGS_BASE_URL=https://bugs.sulkta.com