Register rapp-qonto KeyCape client

sso-mfa/k8s/keycape/deployment.yaml

@@ -54,7 +54,7 @@ spec:
           # 2026-05-24: direct-imported into railiance01 k3s for the
           # bootstrap-console OIDC/MFA rollout. Use IfNotPresent while the
           # HTTP registry push/pull path is being cleaned up.
-          image: 92.205.130.254:32166/coulomb/key-cape:main-nonce-0601
+          image: 92.205.130.254:32166/coulomb/key-cape:main-e877d27-2
           imagePullPolicy: IfNotPresent
 
           ports:
@@ -65,6 +65,11 @@ spec:
           env:
             - name: KEYCAPE_CONFIG
               value: /etc/keycape/config.yaml
+            - name: KEYCAPE_RAPP_QONTO_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: keycape-rapp-qonto-client
+                  key: client-secret
 
           volumeMounts:
             # keycape-config Secret provides config.yaml and key.pem