NK-WP-0056-T09: enroll with a privacyIDEA-generated key, write KV last

Third founder setup run stopped at /token/init. Reproduced on the pinned
privacyIDEA 3.12.2: an admin policy with action '*' enables
totp_force_server_generate, so a supplied otpkey is silently replaced and
verify_enrollment then fails with ERR905. setup now enrolls with genkey=1,
takes the seed from the enrollment response (memory only), confirms with a
code, and writes PASSWORD and TOTP_SEED to KV (CAS=0) last. Failed receipts
kept as evidence.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

docs/evidence/2026-10-31-nk56-t09-synthetic-identity/00-setup-refused-pi-admin-login.json

@@ -0,0 +1,9 @@
+{
+  "action": "setup",
+  "identity": "syn-journey",
+  "phase": "absent",
+  "reason": "pi_admin_login",
+  "source_sha256": "1f921377d6722ec816d330434e777d58277b4e820ed8113f5e1d878752a42562",
+  "status": "failed",
+  "values_recorded": false
+}

docs/evidence/2026-10-31-nk56-t09-synthetic-identity/00-verify-before-setup.json

@@ -0,0 +1,9 @@
+{
+  "action": "verify",
+  "identity": "syn-journey",
+  "phase": "kv",
+  "reason": "kv_shape",
+  "source_sha256": "1f921377d6722ec816d330434e777d58277b4e820ed8113f5e1d878752a42562",
+  "status": "failed",
+  "values_recorded": false
+}

docs/evidence/2026-10-31-nk56-t09-synthetic-identity/01-setup.json

@@ -0,0 +1,10 @@
+{
+  "action": "setup",
+  "identity": "syn-journey",
+  "kv_version": 1,
+  "phase": "pi_token",
+  "reason": "pi_request:/token/init",
+  "source_sha256": "1f921377d6722ec816d330434e777d58277b4e820ed8113f5e1d878752a42562",
+  "status": "failed",
+  "values_recorded": false
+}