feat(sso-mfa): T04 privacyIDEA manifests (NK-WP-0001-T04)

Deploy privacyIDEA (MFA core) in the mfa namespace:
- pvc.yaml: privacyidea-data (5Gi) and privacyidea-logs (2Gi)
- configmap.yaml: pi.cfg reading secrets from env vars
- deployment.yaml: Deployment + ClusterIP Service (port 8080)
- middleware.yaml: Traefik RateLimit + admin IP AllowList
- ingress.yaml: pink.coulomb.social (portal + admin), pink-account.coulomb.social (self-service)
- create-secrets.sh: creates privacyidea-config Secret
- enckey-bootstrap.sh: post-deploy key extraction + DR Secrets
- bootstrap-admin.sh: pi-admin, trigger-admin, privacyidea-trigger-admin Secret
- verify-t04.sh: 8-section done-criteria checker

Config points CP-NK-002 (pink.coulomb.social) and CP-NK-003
(pink-account.coulomb.social) registered in CONFIG.md.

pink = PrivacyIDEA Net Knights (project mnemonic).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/privacyidea/pvc.yaml

@@ -0,0 +1,40 @@
+# PersistentVolumeClaims for privacyIDEA (namespace: mfa)
+#
+# privacyidea-data — /etc/privacyidea/
+#   Holds: enckey, audit signing keys, and any runtime PI config.
+#   PI auto-generates missing key material here on first start.
+#   Run enckey-bootstrap.sh after first deploy to extract keys into
+#   KeePassXC and K8s Secrets (disaster recovery copies).
+#
+# privacyidea-logs — /var/log/privacyidea/
+#   Application log files; separate PVC keeps data PVC clean.
+#
+# Adjust storage sizes before production deployment.
+
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: privacyidea-data
+  namespace: mfa
+  labels:
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+    net-kingdom/component: mfa
+spec:
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: privacyidea-logs
+  namespace: mfa
+  labels:
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+    net-kingdom/component: mfa
+spec:
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 2Gi