Deploy KeyCape client MFA override for coulomb-social

Register coulomb-social with mfaRequired: false, roll key-cape image that
honors client policy, and track NK-WP-0025 public registration orchestration.

sso-mfa/k8s/keycape/register-coulomb-social.py

@@ -26,6 +26,10 @@ CLIENT = {
     "allowedScopes": ["openid", "profile", "email", "groups"],
     "grantTypes": ["authorization_code"],
     "clientType": "public",
+    # Ordinary coulomb.social sessions are AAL1 unless the client explicitly
+    # requests AAL2 through acr_values. Platform/admin clients keep their
+    # existing provider-driven mandatory MFA behavior.
+    "mfaRequired": False,
 }