feat(keycape): add netkingdom OIDC mount and bao.coulomb.social callbacks

Configure OpenBao auth for both netkingdom and keycape mounts with browser
redirect URIs; update verify scripts and runtime architecture notes.

sso-mfa/k8s/verify-t07.sh

@@ -187,6 +187,8 @@ if not target:
 required_redirects = {
     "http://localhost:8250/oidc/callback",
     "http://127.0.0.1:8250/oidc/callback",
+    "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
+    "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
 }
 required_scopes = {"openid", "profile", "email", "groups"}
 missing_redirects = sorted(required_redirects - set(target.get("redirectUris") or []))
@@ -200,7 +202,7 @@ if missing_redirects:
 if missing_scopes:
     print("openbao-admin missing scope(s): " + ", ".join(missing_scopes))
     raise SystemExit(5)
-print("openbao-admin client has local CLI redirects and required scopes")
+print("openbao-admin client has CLI/browser redirects and required scopes")
 ' 2>/dev/null || echo "missing or invalid openbao-admin client")
         if [[ "$OPENBAO_CLIENT_CHECK" == openbao-admin* ]]; then
             pass "$OPENBAO_CLIENT_CHECK"