Establish scoped KeyCape factor custody and verified automatic renewal

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

sso-mfa/k8s/keycape/deployment.yaml

@@ -10,7 +10,7 @@
 #
 # Prerequisites (apply in order):
 #   1. keycape-config Secret     — run keycape/create-secrets.sh
-#   2. keycape-pi-token Secret   — run keycape/create-pi-token.sh (after T04 bootstrap)
+#   2. keycape-factor-read Secret — ESO delivery owned by railiance-platform RPF-WP-0040
 #   3. This file
 #   4. middleware.yaml + ingress.yaml
 #
@@ -83,6 +83,9 @@ spec:
                   key: client-secret
 
           volumeMounts:
+            - name: factor-token
+              mountPath: /etc/keycape-factor
+              readOnly: true
             # keycape-config Secret provides config.yaml and key.pem
             - name: config-secret
               mountPath: /etc/keycape
@@ -119,6 +122,13 @@ spec:
               memory: "128Mi"
 
       volumes:
+        - name: factor-token
+          secret:
+            secretName: keycape-factor-read
+            defaultMode: 0440
+            items:
+              - key: admin-token
+                path: admin-token
         - name: config-secret
           secret:
             secretName: keycape-config