feat(chart): add per-workload service accounts and least-privilege RBAC

[anchapin]

Summary

Replaces the legacy cluster-admin ClusterRoleBinding on the namespace default ServiceAccount with dedicated per-workload ServiceAccounts and a least-privilege Role scoped to the pre-delete hook.

Changes

New: workload-serviceaccounts.yaml

Creates dedicated ServiceAccounts for: web, web-background, worker, rserve, db, redis, nfs-cleanup (pre-delete hook).

Updated: nfs-disconnect-rbac.yaml

• Least-privilege path (default): Creates a Role with only delete on specific Deployments, bound to nfs-cleanup-sa
• Legacy path (opt-in): Keeps the original ClusterRoleBinding cluster-admin binding for backwards compatibility
• Toggle: security.legacyDefaultServiceAccountClusterAdmin.enabled (default: false)

Updated: All deployment specs

Each deployment now references its dedicated ServiceAccount via spec.serviceAccountName.

Updated: aws/cluster_setup.md

Documents the two-phase SA hardening rollout (phase 1: set legacyDefaultServiceAccountClusterAdmin.enabled=true, phase 2: set false).

Values Added

db.serviceAccount.{create,name,annotations}
redis.serviceAccount.{create,name,annotations}
rserve.serviceAccount.{create,name,annotations}
web_background.serviceAccount.{create,name,annotations}
web.serviceAccount.{create,name,annotations}
worker.serviceAccount.{create,name,annotations}
pre_delete_hook.serviceAccount.{create,name,annotations}
security.legacyDefaultServiceAccountClusterAdmin.enabled

Rollout Notes

Apply with --set security.legacyDefaultServiceAccountClusterAdmin.enabled=true first, verify no workload uses default SA, then flip to false.