Fix --seed-node-secret path/stdin bugs; docs title casing

seed_node_conf() (added for sso-manager-node's node-scoped secrets
engine, DESIGN.md §5) had two bugs that made it fail on every call:

- Path had an extra "data/" segment (secret/data/nodes/<id>/<name>).
  bao kv put takes the mount-relative path and inserts "data/" itself
  for KV v2 -- same convention seed_app_conf already uses just above it
  (secret/${vault_path}, not secret/data/${vault_path}). Fixed to
  secret/nodes/<id>/<name>, which resolves under the hood to the
  secret/data/nodes/<id>/* path api_agent_ops.js's node-scope check
  expects.
- It piped "key=value\n" lines to `bao kv put path -`, but `-` there
  means "read a JSON object from stdin", not KV lines -- failed with
  "invalid key/value pair \"-\"" before ever reaching OpenBao. Fixed to
  pass key=value pairs as ordinary CLI args.

Verified against a real OpenBao round-trip (write via the fixed
function, read back both via the CLI and the same HTTP path the SSO's
node-scope check uses).

docs/_config.yml: "theta-suite" -> "Theta Suite" in the Jekyll site title.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/_config.yml

@@ -1,4 +1,4 @@
-title: theta-suite
+title: Theta Suite
 description: A unified, one-command SSO Manager + OIDC proxy stack for home labs and small businesses.
 url: "https://theta42.github.io"
 baseurl: "/theta-suite"