Pin browser-verified account recovery and provider sign-out

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

sso-mfa/k8s/keycape/deployment.yaml

@@ -50,7 +50,7 @@ spec:
         - name: keycape
           # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
           # KEY-WP-0012: canonical OIDC subject resolution for /userinfo.
-          image: forgejo.coulomb.social/coulomb/key-cape@sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a
+          image: forgejo.coulomb.social/coulomb/key-cape@sha256:5f58563aa903ffa0c060e5ae9eb436aa963322d26bdde393efd2dd506dc6c4ed
           imagePullPolicy: IfNotPresent
 
           ports:
@@ -59,6 +59,10 @@ spec:
               protocol: TCP
 
           env:
+            - name: KEYCAPE_ACCOUNT_PORTAL_URL
+              value: https://users.coulomb.social
+            - name: KEYCAPE_BROWSER_LOGOUT_URL
+              value: https://auth.coulomb.social/logout
             - name: KEYCAPE_CONFIG
               value: /etc/keycape/config.yaml
             - name: KEYCAPE_RAPP_QONTO_CLIENT_SECRET