fix(privacyidea): correct image to ghcr.io/gpappsoft, port 5001→8080

privacyidea/privacyidea:3.12 and privacyidea/otpserver:3.12.2 do not
exist on Docker Hub. Correct image is ghcr.io/gpappsoft/privacyidea-docker:3.12.2
which listens on port 8080.

Update all port references: deployment, service, ingress, netpol-mfa,
netpol-sso (keycape→privacyIDEA egress rule).

Also: creds-bootstrap-agent.sh — restart privacyIDEA deployment after
applying new secrets so the pod picks up updated env vars.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/privacyidea/ingress.yaml

@@ -46,7 +46,7 @@ spec:
               service:
                 name: privacyidea
                 port:
-                  number: 5001
+                  number: 8080
   tls:
     - secretName: pink-tls
       hosts:
@@ -83,7 +83,7 @@ spec:
               service:
                 name: privacyidea
                 port:
-                  number: 5001
+                  number: 8080
   tls:
     - secretName: pink-tls
       hosts:
@@ -114,7 +114,7 @@ spec:
               service:
                 name: privacyidea
                 port:
-                  number: 5001
+                  number: 8080
   tls:
     - secretName: pink-account-tls
       hosts: