fix(privacyidea): correct image to ghcr.io/gpappsoft, port 5001→8080

privacyidea/privacyidea:3.12 and privacyidea/otpserver:3.12.2 do not
exist on Docker Hub. Correct image is ghcr.io/gpappsoft/privacyidea-docker:3.12.2
which listens on port 8080.

Update all port references: deployment, service, ingress, netpol-mfa,
netpol-sso (keycape→privacyIDEA egress rule).

Also: creds-bootstrap-agent.sh — restart privacyIDEA deployment after
applying new secrets so the pod picks up updated env vars.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/privacyidea/deployment.yaml

@@ -10,8 +10,8 @@
 #   5. enckey-bootstrap.sh — extract enckey + audit keys, create DR Secrets
 #   6. bootstrap-admin.sh  — create pi-admin (+ MFA enrolment) and trigger-admin
 #
-# Container port: 5001.
-# privacyidea/otpserver listens on port 5001 internally.
+# Container port: 8080.
+# ghcr.io/gpappsoft/privacyidea-docker listens on port 8080 (gunicorn).
 
 apiVersion: apps/v1
 kind: Deployment
@@ -53,14 +53,15 @@ spec:
       containers:
         - name: privacyidea
           # Pin to a specific release; update via image update policy.
-          # Official image: https://hub.docker.com/r/privacyidea/otpserver
-          # privacyidea/privacyidea:3.12 does not exist — correct repo is otpserver.
-          image: privacyidea/otpserver:3.12.2
+          # Official image: https://github.com/gpappsoft/privacyidea-docker
+          # privacyidea/privacyidea:3.12 and privacyidea/otpserver:3.12.2 do not exist.
+          # Correct image: ghcr.io/gpappsoft/privacyidea-docker:3.12.2 (port 8080)
+          image: ghcr.io/gpappsoft/privacyidea-docker:3.12.2
           imagePullPolicy: IfNotPresent
 
           ports:
             - name: http
-              containerPort: 5001
+              containerPort: 8080
               protocol: TCP
 
           # ── Environment — sensitive values from Secret ──────────────────
@@ -86,20 +87,20 @@ spec:
           # Startup probe: give PI up to 3 min to run DB migrations on first boot.
           startupProbe:
             tcpSocket:
-              port: 5001
+              port: 8080
             initialDelaySeconds: 15
             periodSeconds: 10
             failureThreshold: 18   # 18 × 10s = 3 min
           livenessProbe:
             tcpSocket:
-              port: 5001
+              port: 8080
             initialDelaySeconds: 0
             periodSeconds: 15
             failureThreshold: 3
           readinessProbe:
             httpGet:
               path: /token/
-              port: 5001
+              port: 8080
             initialDelaySeconds: 0
             periodSeconds: 10
             failureThreshold: 3
@@ -143,6 +144,6 @@ spec:
     app.kubernetes.io/name: privacyidea
   ports:
     - name: http
-      port: 5001
-      targetPort: 5001
+      port: 8080
+      targetPort: 8080
       protocol: TCP