fix(privacyidea): correct image to ghcr.io/gpappsoft, port 5001→8080

privacyidea/privacyidea:3.12 and privacyidea/otpserver:3.12.2 do not
exist on Docker Hub. Correct image is ghcr.io/gpappsoft/privacyidea-docker:3.12.2
which listens on port 8080.

Update all port references: deployment, service, ingress, netpol-mfa,
netpol-sso (keycape→privacyIDEA egress rule).

Also: creds-bootstrap-agent.sh — restart privacyIDEA deployment after
applying new secrets so the pod picks up updated env vars.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/network-policies/netpol-mfa.yaml

@@ -1,8 +1,8 @@
 # NetworkPolicies for the mfa namespace (privacyIDEA)
 #
 # Allowed paths:
-#   INGRESS: Traefik (kube-system) → privacyIDEA :5001  (user-facing portal)
-#   INGRESS: KeyCape (sso) → privacyIDEA :5001           (Provider API calls)
+#   INGRESS: Traefik (kube-system) → privacyIDEA :8080  (user-facing portal)
+#   INGRESS: KeyCape (sso) → privacyIDEA :8080           (Provider API calls)
 #   EGRESS:  privacyIDEA → databases :5432                (PostgreSQL)
 #   EGRESS:  all pods → kube-dns :53                      (UDP+TCP)
 #
@@ -42,7 +42,7 @@ spec:
             matchLabels:
               app.kubernetes.io/name: traefik
       ports:
-        - port: 5001
+        - port: 8080
           protocol: TCP
 ---
 # ── Allow ingress from KeyCape (Provider API calls) ──────────────────────────
@@ -66,7 +66,7 @@ spec:
             matchLabels:
               app.kubernetes.io/name: keycape
       ports:
-        - port: 5001
+        - port: 8080
           protocol: TCP
 ---
 # ── Allow egress to PostgreSQL ───────────────────────────────────────────────

sso-mfa/k8s/network-policies/netpol-sso.yaml

@@ -13,7 +13,7 @@
 # Allowed egress paths:
 #   keycape  → authelia :9091  (OIDC callback orchestration)
 #   keycape  → lldap    :3890  (LDAP user lookups)
-#   keycape  → mfa      :5001  (privacyIDEA MFA check and token validation)
+#   keycape  → mfa      :8080  (privacyIDEA MFA check and token validation)
 #   authelia → lldap    :3890  (LDAP authentication backend)
 #   all pods → kube-dns :53    (DNS resolution)
 #
@@ -201,7 +201,7 @@ spec:
         - port: 3890
           protocol: TCP
 ---
-# ── KeyCape egress → privacyIDEA (mfa namespace) :5001 ───────────────────────
+# ── KeyCape egress → privacyIDEA (mfa namespace) :8080 ───────────────────────
 # KeyCape calls privacyIDEA to check and validate MFA tokens.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
@@ -220,7 +220,7 @@ spec:
             matchLabels:
               net-kingdom/component: mfa
       ports:
-        - port: 5001
+        - port: 8080
           protocol: TCP
 ---
 # ── Authelia egress → LLDAP (within sso namespace) ───────────────────────────