chore(workplan): NK-WP-0003-T08 blocked — DNS records + Go missing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/NK-WP-0003-keycape-privacyidea-cluster-deployment.md

@@ -248,9 +248,21 @@ Verify: OIDC discovery endpoint reachable at
 
 ```task
 id: NK-WP-0003-T08
-status: todo
+status: blocked
 priority: high
 state_hub_task_id: "0fba3392-c916-43fd-a2c1-24ce39481043"
+note: Blocked 2026-03-22 — two prerequisites missing:
+      1. DNS records: kc/auth/pink/lldap.coulomb.social have NO A records. Cloudflare
+         DNS must be updated (no API token in repo). Once DNS propagates ACME challenges
+         will resolve and certs will be issued automatically.
+         Records needed: kc → 92.205.130.254, auth → 92.205.130.254, pink → 92.205.130.254
+         lldap → 92.205.130.254 (all proxied=false / DNS-only in Cloudflare for HTTP-01)
+      2. Go not installed on CoulombCore — `go test ./tests/...` fails with "go: not found".
+         Install: wget https://go.dev/dl/go1.22.5.linux-amd64.tar.gz && sudo tar -C /usr/local -xzf go1.22.5.linux-amd64.tar.gz
+      Partial validation already done (2026-03-22):
+        - OIDC discovery: http://localhost:18080/.well-known/openid-configuration ✓ (via port-forward)
+        - /healthz: {"status":"ok","version":"0.1.0"} ✓
+        - All 4 services 1/1 Running ✓
 ```
 
 Prove the full auth flow works: