Register coulomb-social with mfaRequired: false, roll key-cape image that honors client policy, and track NK-WP-0025 public registration orchestration.
Idempotent patch of sso/keycape-config with public PKCE client and redirect URIs for local :8008 and production coulomb.social callbacks.
