feat(sso-mfa): T07/T08 user mgmt, backups, DR & break-glass (NK-WP-0001-T07/T08)

T07 — User management & self-service:
- k8s/lldap/bootstrap-users.sh: creates net-kingdom-users and net-kingdom-admins
  groups in LLDAP via GraphQL API; idempotent.
- k8s/lldap/break-glass.sh: creates break-glass bypass account in LLDAP,
  sets BREAKGLASS_PASSWORD, assigns to net-kingdom-admins.
- k8s/verify-t07.sh: 6 checks — groups, break-glass, self-service portal,
  KeyCape OIDC client registrations.

T08 — Backups, DR, break-glass:
- k8s/backup/cronjob-sqlite-backups.yaml: daily CronJobs for LLDAP SQLite,
  Authelia SQLite (with scale-down/up RBAC), and privacyIDEA enckey backup.
  7-day retention, 03:00/03:15/03:30 UTC staggered schedule.
- k8s/backup/DR-RUNBOOK.md: full restore runbook — scenarios, restore order,
  LLDAP/Authelia/PI SQLite restore procedure, full node rebuild sequence,
  offsite age-encrypted export.
- k8s/verify-t08.sh: 9 checks — CronJobs, RBAC, run history, backup files
  on PVCs, DR runbook presence, offsite backup (manual confirmation).
- WORKPLAN.md: T07/T08 sections with done-criteria added.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/WORKPLAN.md

@@ -1,7 +1,7 @@
 # SSO-MFA Platform — Stack Migration Workplan
 # NK-WP-0001 — Keycloak → Authelia + LLDAP + KeyCape
 
-**Updated:** 2026-03-19 (T06 in progress)
+**Updated:** 2026-03-19 (T06 pending cluster; T07/T08 manifests complete)
 **Workstream:** sso-mfa-platform (39263c4b-ef70-4053-b782-350834b7e1be)
 
 ## Stack Decision
@@ -24,8 +24,8 @@ Hostnames: kc.coulomb.social (KeyCape), auth.coulomb.social (Authelia), lldap.co
 | T04 — privacyIDEA | 6ad1296a | **todo** | Manifests exist in k8s/privacyidea/; pending cluster |
 | T05 — SSO core (new stack) | b9f73aa6 | done | commit 0754dc3 |
 | T06 — Realm config & MFA flow | 3b6379a4 | **in-progress** | See below |
-| T07 — User mgmt & self-service | c7cf902a | todo | |
-| T08 — Backups, DR, break-glass | 9cbd1d89 | todo | |
+| T07 — User mgmt & self-service | c7cf902a | **in-progress** | See below |
+| T08 — Backups, DR, break-glass | 9cbd1d89 | **in-progress** | See below |
 
 ## T05 — SSO Core (new stack: LLDAP + Authelia + KeyCape)
 
@@ -76,3 +76,49 @@ Hostnames: kc.coulomb.social (KeyCape), auth.coulomb.social (Authelia), lldap.co
 - KeyCape→privacyIDEA token list API returns status=True
 - At least one user has enrolled a TOTP token
 - verify-t06.sh: 0 FAILs
+
+## T07 — User mgmt & self-service
+
+### Deliverables
+- [x] `k8s/lldap/bootstrap-users.sh` — creates net-kingdom-users and net-kingdom-admins groups in LLDAP via GraphQL API
+- [x] `k8s/lldap/break-glass.sh` — creates the break-glass bypass account and assigns to net-kingdom-admins
+- [x] `k8s/verify-t07.sh` — verifies groups, break-glass user, self-service portal, OIDC client registrations
+
+### Pending (needs live cluster)
+- [ ] Run `lldap/bootstrap-users.sh` to create groups
+- [ ] Run `lldap/break-glass.sh` to create break-glass account
+- [ ] Add first real user via LLDAP WebUI (lldap.coulomb.social)
+- [ ] Register first OIDC client in `keycape/create-secrets.sh` (clients: block)
+- [ ] User self-enrolls TOTP at pink-account.coulomb.social
+- [ ] Run `verify-t07.sh` — 0 FAILs
+
+### Done-criteria for T07
+- Groups net-kingdom-users and net-kingdom-admins exist in LLDAP
+- break-glass user exists and is in net-kingdom-admins
+- At least one regular user exists
+- At least one OIDC client registered in KeyCape
+- verify-t07.sh: 0 FAILs
+
+## T08 — Backups, DR, break-glass
+
+### Deliverables
+- [x] `k8s/backup/cronjob-sqlite-backups.yaml` — daily SQLite backup CronJobs for LLDAP, Authelia, privacyIDEA; RBAC for Authelia scale-down/up
+- [x] `k8s/backup/DR-RUNBOOK.md` — full restore runbook: scenarios, restore order, node rebuild procedure, offsite export
+- [x] `k8s/verify-t08.sh` — verifies CronJobs, RBAC, backup files on PVCs, DR runbook presence
+
+### Pending (needs live cluster)
+- [ ] Apply `backup/cronjob-sqlite-backups.yaml`
+- [ ] Trigger each CronJob manually once to verify they run clean:
+      `kubectl create job -n sso --from=cronjob/lldap-backup lldap-backup-test`
+      `kubectl create job -n sso --from=cronjob/authelia-backup authelia-backup-test`
+      `kubectl create job -n mfa --from=cronjob/privacyidea-backup pi-backup-test`
+- [ ] Confirm backup files appear on PVCs
+- [ ] Run offsite export: pull backup files, encrypt with age, store offsite
+- [ ] Run `verify-t08.sh` — 0 FAILs
+
+### Done-criteria for T08
+- All three backup CronJobs deployed and have ≥1 successful run
+- Backup files confirmed on PVCs
+- DR-RUNBOOK.md reviewed by operator
+- Offsite ops bundle current (pack-bundle.sh run after all secrets finalised)
+- verify-t08.sh: 0 FAILs