chore(creds): encrypted secrets [agent NK-WP-0005]

sso-mfa/bootstrap/creds-state.yaml

@@ -22,11 +22,11 @@ secrets_applied:
   lldap: true
   authelia: true
   privacyidea: true
-  keycape:     false
+  keycape: true
 
 # Post-apply bootstrap (agent-run when pod is Ready)
 enckey_bootstrapped: true
-pi_admin_created: true
+pi_admin_created: false
 
 # Derived: all true → bootstrap complete
 bootstrap_complete: false