fix(sso-mfa): NK-WP-0003-T04 — correct privacyIDEA image and port

privacyidea/privacyidea:3.12 does not exist on Docker Hub.
Correct image: privacyidea/otpserver:3.12.2 (port 5001).

Updated files:
- deployment.yaml: image, containerPort, probes, service port
- ingress.yaml: backend service port
- netpol-mfa.yaml: ingress port + keycloak → keycape label
- netpol-sso.yaml: KeyCape egress port to privacyIDEA

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/NK-WP-0003-keycape-privacyidea-cluster-deployment.md

@@ -134,6 +134,10 @@ state_hub_task_id: "9c9c1ec9-0cf5-4546-a83e-d74dbf3b27af"
 
 Deploy privacyIDEA into the `mfa` namespace.
 
+> **Image fix applied (2026-03-20):** `privacyidea/privacyidea:3.12` does not exist.
+> Corrected to `privacyidea/otpserver:3.12.2` on port 5001.
+> Updated: `deployment.yaml`, `ingress.yaml`, `netpol-mfa.yaml`, `netpol-sso.yaml`.
+
 **Step 1 — Create K8s secrets from KeePassXC:**
 ```bash
 cd sso-mfa/k8s/privacyidea