chore(creds): encrypted secrets [agent NK-WP-0005]

sso-mfa/bootstrap/creds-state.yaml

@@ -25,8 +25,8 @@ secrets_applied:
   keycape:     false
 
 # Post-apply bootstrap (agent-run when pod is Ready)
-enckey_bootstrapped:  false
-pi_admin_created:     false
+enckey_bootstrapped: true
+pi_admin_created: true
 
 # Derived: all true → bootstrap complete
 bootstrap_complete: false

sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> X25519 iXg5LItvsPi0WbdSrtqMSRLvdzl54r+6t+GAsmwlUxI
+Rld/KatZ69DaRTVj8z6FixuHSkHgOKAe5R1evgDNCVg
+--- NZPzrPNZvqJLhsdBcBNSEYU4+acvHy1WAPMhEoSQcRU
+Ñöü<>2†…¤œ«º‚