NG: bitwarden-cli bridge: liveness probe requires the unlocked status

`bw serve` can lose its login while /sync still answers; every lookup then
fails with 500. The probe now also checks /status, so the pod restarts itself.

Co-Authored-By: Claude <noreply@anthropic.com>

k8s-ng/core/secret-stores/bitwarden-cli.yaml

@@ -62,15 +62,19 @@ spec:
               containerPort: 8087
               protocol: TCP
           livenessProbe:
+            # Syncs the vault and requires the bridge to be logged in: `bw serve` can
+            # lose its login (status "unauthenticated") while /sync still answers, and
+            # every lookup then fails with 500. Failing the probe restarts the pod.
             exec:
               command:
-                - wget
-                - -q
-                - http://127.0.0.1:8087/sync
-                - --post-data=''
+                - sh
+                - -c
+                - >-
+                  wget -q -O /dev/null --post-data='' http://127.0.0.1:8087/sync &&
+                  wget -q -O - http://127.0.0.1:8087/status | grep -q '"status":"unlocked"'
             initialDelaySeconds: 20
             failureThreshold: 3
-            timeoutSeconds: 1
+            timeoutSeconds: 10
             periodSeconds: 120
           readinessProbe:
             tcpSocket: