Match the Kanidm server to the CLI, and say why a token failed

Three things in one setup run, two of them mine.

The server image was 1.11.1 while the host's CLI is 1.11.2, and a
1.11.2 client looks up the domain entry at a UUID 1.11.1 does not
have. So `system domain set-displayname` and `set-image` both failed
with "Item not found", which says nothing about versions. The CLI had
been warning about the mismatch on every single call. Image bumped to
1.11.2; the README says to keep them together and which one to move.

The onboarding token asked for `--rw`, and the flag is spelled
`--readwrite`. The script swallowed stderr and reported a bare warning,
so a step that leaves every invite failing closed said nothing about
why. It now passes the right flag, and if it still fails it says what
the CLI said and prints the command to retry by hand.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

compose.yml

@@ -59,7 +59,7 @@ services:
       retries: 3
 
   kanidm:
-    image: kanidm/server:1.11.1
+    image: kanidm/server:1.11.2
     restart: unless-stopped
     environment:
       KANIDM_CONFIG_PATH: /data/server.toml