feat(sso-mfa): T02/T03 live apply — age-encrypted secrets, CNPG cluster (NK-WP-0001-T02/T03)

- Add encrypt-secrets.sh / decrypt-secrets.sh: age-based secrets workflow
  replaces KeePassXC dependency; encrypted .env.age files committed to repo
- Add bootstrap/secrets.enc/: all component secrets encrypted to age pubkey
- Fix .gitignore: allow secrets.enc/**/*.age while blocking plaintext
- Fix verify-t02.sh: update netpol names for Authelia+LLDAP+KeyCape stack
- Fix verify-t03.sh: remove keycloak_db/role checks; fix ((PASS++)) set-e bug
- Update postgresql/cluster.yaml: drop keycloak_db, bootstrap privacyidea_db only
- Update postgresql/create-secrets.sh: remove keycloak secret
- Fix netpol-databases.yaml: add port 8000 for CNPG instance manager HTTP API
- T02 COMPLETE: namespaces, network policies, cert-manager issuers applied
- T03 COMPLETE: CNPG operator installed, net-kingdom-pg cluster healthy

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/verify-t02.sh

@@ -62,9 +62,8 @@ for ns in sso mfa databases; do
     check "allow-egress-dns in $ns" \
         $KUBECTL get networkpolicy allow-egress-dns -n "$ns"
 done
-check "allow-ingress-from-traefik in sso"       $KUBECTL get networkpolicy allow-ingress-from-traefik -n sso
-check "allow-egress-to-postgres in sso"         $KUBECTL get networkpolicy allow-egress-to-postgres -n sso
-check "allow-egress-to-privacyidea in sso"      $KUBECTL get networkpolicy allow-egress-to-privacyidea -n sso
+check "allow-traefik-to-keycape in sso"          $KUBECTL get networkpolicy allow-traefik-to-keycape -n sso
+check "allow-keycape-egress-to-privacyidea in sso" $KUBECTL get networkpolicy allow-keycape-egress-to-privacyidea -n sso
 check "allow-ingress-from-traefik in mfa"       $KUBECTL get networkpolicy allow-ingress-from-traefik -n mfa
 check "allow-ingress-from-keycloak in mfa"      $KUBECTL get networkpolicy allow-ingress-from-keycloak -n mfa
 check "allow-egress-to-postgres in mfa"         $KUBECTL get networkpolicy allow-egress-to-postgres -n mfa