chore(creds): encrypted secrets [agent NK-WP-0005]

sso-mfa/bootstrap/creds-state.yaml

@@ -22,11 +22,11 @@ secrets_applied:
   lldap: true
   authelia: true
   privacyidea: true
-  keycape:     false
+  keycape: true
 
 # Post-apply bootstrap (agent-run when pod is Ready)
 enckey_bootstrapped: true
-pi_admin_created: true
+pi_admin_created: false
 
 # Derived: all true → bootstrap complete
 bootstrap_complete: false

sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> X25519 07rQFhkhdJod0LA2ITJtukS2hHCbOVfPYFUIadgzSD0
+-> X25519 0cL2SNhcEH4wBC1vfpvRl9FxngjQTTxDYLlxOJUEVE8
-SKN1Ue8uPW18Pf5AHfhfsFQVHQLIcEN5Gyjlm8DOwik
+5OYPPIRd+p4WLSDP41pj48L4/vX8yiqaLqkROpEszuY
---- +TSu1Sv/56OWNFLwLWR22dKBeIVJcF9+DNO7GeVuMX4
+--- R9SZeBe8nV0AqCzYqF+ww6z0g13TI/tSYOHCt+CcGE4
-%¤ùÈiˆv}FퟥõÛYÕF)õ%C[åÙe²ôŠþ°‡ößA-¡Ô¥gn…iãæŸlÁ-o§wX<Õ‚QÝg
+>îXßáAŠR¾/˜ÑɤÀòjqvL½0Ly&Ö3ºzn<7A>¥¾ø>O<>/ç]±ü¡ˆmºàÊ×¹<C397>Xs¦47ø=¸œ'S×:¨	t
-yE¬)£ê‘ptAì¼Ñî:{