docs(sso-mfa): fix stale Keycloak refs and add T04 apply section to WORKPLAN

- README.md: ipAllowList → ipWhiteList (match Traefik v2 fix)
- verify-t04.sh: update success message (Keycloak → LLDAP+Authelia+KeyCape)
- WORKPLAN.md: add full T04 section with deliverables, pending steps, done-criteria

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/privacyidea/README.md

@@ -149,7 +149,7 @@ cluster-internal and not subject to the Ingress middleware.
 
 ### Admin WebUI IP restriction
 
-Update `middleware.yaml` `privacyidea-admin-allowlist.spec.ipAllowList.sourceRange`
+Update `middleware.yaml` `privacyidea-admin-allowlist.spec.ipWhiteList.sourceRange`
 to your actual VPN/office CIDRs and reapply:
 
 ```bash

sso-mfa/k8s/verify-t04.sh

@@ -212,6 +212,6 @@ elif [[ "$WARN" -gt 0 ]]; then
     echo "  Result: PARTIAL — T04 core is up; WARN items should be resolved before T05"
     exit 0
 else
-    echo "  Result: COMPLETE — T04 done-criteria met; proceed to T05 (Keycloak)"
+    echo "  Result: COMPLETE — T04 done-criteria met; proceed to T05 (SSO core: LLDAP+Authelia+KeyCape)"
     exit 0
 fi