feat(sso-mfa): T02 K8s foundations manifests (NK-WP-0001-T02)

namespaces/namespaces.yaml:
  - sso, mfa, databases with net-kingdom/component labels for NetworkPolicy selectors

network-policies/{netpol-sso,netpol-mfa,netpol-databases}.yaml:
  - Default-deny-all posture on all three namespaces
  - sso: ingress from Traefik; egress to databases:5432 and mfa:8080
  - mfa: ingress from Traefik + Keycloak; egress to databases:5432
  - databases: ingress from sso/mfa + CNPG operator; egress to kube-dns + K8s API
  - DNS (kube-system:53) allowed for all pods in all namespaces

cert-manager/issuers.yaml:
  - selfsigned-issuer (ClusterIssuer) for internal/test use
  - letsencrypt-prod (ClusterIssuer, HTTP-01/Traefik) — fill ACME_EMAIL before apply
cert-manager/test-certificate.yaml:
  - 24h self-signed cert to smoke-test cert-manager

storage/verify-pvc.yaml:
  - Test PVC + Pod to confirm default StorageClass provisioning

verify-t02.sh:
  - Full verification script: namespaces, NetworkPolicies, issuers, certs, StorageClass

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/namespaces/namespaces.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: sso
+  labels:
+    # net-kingdom component label — used in NetworkPolicy namespaceSelector
+    net-kingdom/component: sso
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mfa
+  labels:
+    net-kingdom/component: mfa
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: databases
+  labels:
+    net-kingdom/component: databases
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa