feat(sso-mfa): T04 privacyIDEA manifests (NK-WP-0001-T04)

Deploy privacyIDEA (MFA core) in the mfa namespace:
- pvc.yaml: privacyidea-data (5Gi) and privacyidea-logs (2Gi)
- configmap.yaml: pi.cfg reading secrets from env vars
- deployment.yaml: Deployment + ClusterIP Service (port 8080)
- middleware.yaml: Traefik RateLimit + admin IP AllowList
- ingress.yaml: pink.coulomb.social (portal + admin), pink-account.coulomb.social (self-service)
- create-secrets.sh: creates privacyidea-config Secret
- enckey-bootstrap.sh: post-deploy key extraction + DR Secrets
- bootstrap-admin.sh: pi-admin, trigger-admin, privacyidea-trigger-admin Secret
- verify-t04.sh: 8-section done-criteria checker

Config points CP-NK-002 (pink.coulomb.social) and CP-NK-003
(pink-account.coulomb.social) registered in CONFIG.md.

pink = PrivacyIDEA Net Knights (project mnemonic).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/privacyidea/ingress.yaml

@@ -0,0 +1,121 @@
+# Ingress — privacyIDEA (namespace: mfa)
+#
+# pink.coulomb.social       — main portal (login, self-service, API)
+# pink-account.coulomb.social — self-service token portal
+#
+# Both hostnames resolve to the same privacyIDEA Service.
+# privacyIDEA serves the self-service portal at /account/ when the
+# "privacyideaserver" policy for self-service is enabled (configured
+# in bootstrap-admin.sh / T04 README).
+#
+# TLS: cert-manager issues certificates via the letsencrypt-prod ClusterIssuer
+# (T02). Public DNS for both hostnames must resolve to the cluster's external IP
+# before cert-manager can complete the ACME HTTP-01 challenge.
+#
+# Rate limiting: the privacyidea-rate-limit middleware (middleware.yaml) is
+# applied to pink.coulomb.social. Admin paths are further restricted by
+# privacyidea-admin-allowlist applied in the separate /admin Ingress below.
+#
+# Config points (see CONFIG.md):
+#   CP-NK-002  pink.coulomb.social
+#   CP-NK-003  pink-account.coulomb.social
+
+# ── Main portal — pink.coulomb.social ────────────────────────────────────────
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: privacyidea
+  namespace: mfa
+  labels:
+    app.kubernetes.io/name: privacyidea
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+    net-kingdom/component: mfa
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Rate-limit middleware (Traefik v3 format; see middleware.yaml for v2 note).
+    traefik.ingress.kubernetes.io/router.middlewares: "mfa-privacyidea-rate-limit@kubernetescrd"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: pink.coulomb.social
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: privacyidea
+                port:
+                  number: 8080
+  tls:
+    - secretName: pink-tls
+      hosts:
+        - pink.coulomb.social
+---
+# ── Admin WebUI — pink.coulomb.social/admin — restricted to VPN/office IPs ──
+# Separate Ingress so the admin-allowlist middleware applies only to /admin/*.
+# The main Ingress above already handles / (which includes /admin/ by prefix);
+# this Ingress's more-specific /admin path takes precedence in Traefik routing.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: privacyidea-admin
+  namespace: mfa
+  labels:
+    app.kubernetes.io/name: privacyidea
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+    net-kingdom/component: mfa
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Both rate-limit AND IP allowlist for admin paths.
+    traefik.ingress.kubernetes.io/router.middlewares: >-
+      mfa-privacyidea-rate-limit@kubernetescrd,
+      mfa-privacyidea-admin-allowlist@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: pink.coulomb.social
+      http:
+        paths:
+          - path: /admin
+            pathType: Prefix
+            backend:
+              service:
+                name: privacyidea
+                port:
+                  number: 8080
+  tls:
+    - secretName: pink-tls
+      hosts:
+        - pink.coulomb.social
+---
+# ── Self-service portal — pink-account.coulomb.social ────────────────────────
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: privacyidea-account
+  namespace: mfa
+  labels:
+    app.kubernetes.io/name: privacyidea
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+    net-kingdom/component: mfa
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: "mfa-privacyidea-rate-limit@kubernetescrd"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: pink-account.coulomb.social
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: privacyidea
+                port:
+                  number: 8080
+  tls:
+    - secretName: pink-account-tls
+      hosts:
+        - pink-account.coulomb.social