chore(creds): encrypted secrets [agent NK-WP-0005]

sso-mfa/bootstrap/creds-state.yaml

@@ -18,10 +18,10 @@ emergency_bundle_delivered_at: null
 
 # Cluster injection (per-component)
 secrets_applied:
-  postgres:    false
-  lldap:       false
-  authelia:    false
-  privacyidea: false
+  postgres: true
+  lldap: true
+  authelia: true
+  privacyidea: true
   keycape:     false
 
 # Post-apply bootstrap (agent-run when pod is Ready)