feat: accept KeyCape approval clients with tested recovery

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

sso-mfa/k8s/keycape/deployment.yaml

@@ -1,8 +1,8 @@
 # Deployment + Service — KeyCape (namespace: sso)
 #
-# KeyCape is the OIDC orchestration layer. It is stateless: all persistent
-# state lives in Authelia (session), LLDAP (users), and privacyIDEA (MFA tokens).
-# No PVC is required.
+# KeyCape orchestrates OIDC. Pending logins and authorization codes are process-local;
+# use one replica with Recreate during replacement. Persistent identity state remains
+# in Authelia, LLDAP and privacyIDEA. No PVC is required.
 #
 # Configuration is stored entirely in the keycape-config Secret, which holds
 # a complete config.yaml and the RSA private key used to sign OIDC tokens
@@ -33,7 +33,7 @@ spec:
     matchLabels:
       app.kubernetes.io/name: keycape
   strategy:
-    type: RollingUpdate   # stateless — safe to roll
+    type: Recreate        # one issuer instance; process-local login/code state
   template:
     metadata:
       labels:
@@ -50,7 +50,7 @@ spec:
         - name: keycape
           # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
           # KEY-WP-0012: canonical OIDC subject resolution for /userinfo.
-          image: forgejo.coulomb.social/coulomb/key-cape:main-153258b
+          image: forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611
           imagePullPolicy: IfNotPresent
 
           ports:
@@ -67,6 +67,17 @@ spec:
                   name: keycape-rapp-qonto-client
                   key: client-secret
 
+            - name: KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: keycape-secrets-engine-approval-client
+                  key: client-secret
+            - name: KEYCAPE_APPROVAL_ENGINE_OPERATOR_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: keycape-approval-engine-operator-client
+                  key: client-secret
+
           volumeMounts:
             # keycape-config Secret provides config.yaml and key.pem
             - name: config-secret
@@ -89,7 +100,7 @@ spec:
             failureThreshold: 3
           readinessProbe:
             httpGet:
-              path: /healthz
+              path: /readyz
               port: 8080
             initialDelaySeconds: 0
             periodSeconds: 10