fix(privacyidea): correct image to ghcr.io/gpappsoft, port 5001→8080

privacyidea/privacyidea:3.12 and privacyidea/otpserver:3.12.2 do not
exist on Docker Hub. Correct image is ghcr.io/gpappsoft/privacyidea-docker:3.12.2
which listens on port 8080.

Update all port references: deployment, service, ingress, netpol-mfa,
netpol-sso (keycape→privacyIDEA egress rule).

Also: creds-bootstrap-agent.sh — restart privacyIDEA deployment after
applying new secrets so the pod picks up updated env vars.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/network-policies/netpol-mfa.yaml

@@ -1,8 +1,8 @@
 # NetworkPolicies for the mfa namespace (privacyIDEA)
 #
 # Allowed paths:
-#   INGRESS: Traefik (kube-system) → privacyIDEA :5001  (user-facing portal)
-#   INGRESS: KeyCape (sso) → privacyIDEA :5001           (Provider API calls)
+#   INGRESS: Traefik (kube-system) → privacyIDEA :8080  (user-facing portal)
+#   INGRESS: KeyCape (sso) → privacyIDEA :8080           (Provider API calls)
 #   EGRESS:  privacyIDEA → databases :5432                (PostgreSQL)
 #   EGRESS:  all pods → kube-dns :53                      (UDP+TCP)
 #
@@ -42,7 +42,7 @@ spec:
             matchLabels:
               app.kubernetes.io/name: traefik
       ports:
-        - port: 5001
+        - port: 8080
           protocol: TCP
 ---
 # ── Allow ingress from KeyCape (Provider API calls) ──────────────────────────
@@ -66,7 +66,7 @@ spec:
             matchLabels:
               app.kubernetes.io/name: keycape
       ports:
-        - port: 5001
+        - port: 8080
           protocol: TCP
 ---
 # ── Allow egress to PostgreSQL ───────────────────────────────────────────────