feat(keycape): add netkingdom OIDC mount and bao.coulomb.social callbacks

Configure OpenBao auth for both netkingdom and keycape mounts with browser
redirect URIs; update verify scripts and runtime architecture notes.

sso-mfa/k8s/keycape/openbao-client-config.py

@@ -22,10 +22,12 @@ except ImportError as exc:  # pragma: no cover - operator environment guard
 
 OPENBAO_CLIENT = {
     "clientId": "openbao-admin",
-    "displayName": "Railiance OpenBao Admin CLI",
+    "displayName": "Railiance OpenBao Admin",
     "redirectUris": [
         "http://localhost:8250/oidc/callback",
         "http://127.0.0.1:8250/oidc/callback",
+        "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
+        "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
     ],
     "allowedScopes": ["openid", "profile", "email", "groups"],
     "grantTypes": ["authorization_code"],