fix(sso-mfa): commit T02–T06 fixes and workplan status updates

- authelia: users_filter uid→{username_attribute}, OIDC client secret
  moved from env var to inline bcrypt hash in configmap (4.38 limitation)
- authelia: remove unsupported CLIENTS_0_SECRET_FILE env var
- lldap: drop runAsNonRoot/runAsUser (image init requires root)
- verify-t02: keycloak→keycape NetworkPolicy check rename
- workplan: T02/T03/T05/T06 marked done with notes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/lldap/deployment.yaml

@@ -37,8 +37,8 @@ spec:
         net-kingdom/component: sso
     spec:
       securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
+        # lldap/lldap:stable initialises /app as root then drops privileges
+        # internally — runAsNonRoot/runAsUser would prevent that init step.
         fsGroup: 1000
 
       containers: