Implement P05 checked services and safe selected delivery recovery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/cmd/keycape/main.go

@@ -225,6 +225,7 @@ func main() {
 		}},
 		readiness.Check{Name: "authelia", Probe: httpReachable(cfg.Authelia.TokenBaseURL, cfg.Authelia.BaseURL)},
 		readiness.Check{Name: "privacyidea", Probe: httpReachable(cfg.PrivacyIDEA.BaseURL)},
+		readiness.Check{Name: "factor_reader", Probe: privacyIDEAAdapter.Probe},
 	))
 
 	// Liveness only: this says the process is up, and deliberately probes

src/internal/adapters/privacyidea/adapter.go

@@ -124,6 +124,11 @@ func (a *PrivacyIDEAAdapter) hasActiveToken(ctx context.Context, userID string)
 	return false, nil
 }
 
+// Probe checks the current mounted credential and realm visibility without reading a user factor.
+func (a *PrivacyIDEAAdapter) Probe(ctx context.Context) error {
+	return a.verifyReadScope(ctx)
+}
+
 // verifyReadScope distinguishes no enrolled factor from lost realm visibility.
 // privacyIDEA returns a successful empty list for a reader with withdrawn rights.
 func (a *PrivacyIDEAAdapter) verifyReadScope(ctx context.Context) error {