Add narrow ingress-read RBAC for management-platform-sa in default ns

Odoo's and Nextcloud's Ingress objects live in the default namespace
(historical, from the original Docker->k8s migration) rather than their
own app namespace like n8n/mautic/erpnext. management-platform-sa had
no binding there at all. Granting the full backup ClusterRole in
default would be way too broad (default also hosts unrelated live
services, and that role includes secrets/pod writes) - so this adds a
separate ClusterRole scoped to just ingresses get/list/watch, bound
only in default. Needed for the Application Sites page fix (next
commit) to read real domain/TLS state instead of guessing.

Applied and verified live: can read ingresses in default, still denied
secrets/pod-delete there.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017avLHFqkiti3g62Anq9sVA

management-platform-sites-rbac.yaml

@@ -0,0 +1,32 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: management-platform-ingress-reader-role
+  labels: {owner: ameni-boukattaya, app.kubernetes.io/managed-by: navitrends-pfe-migration}
+rules:
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+---
+# Odoo's and Nextcloud's Ingress objects live in the `default` namespace
+# (historical — created there during the original Docker->k8s migration,
+# unlike n8n/mautic/erpnext whose Ingress lives in their own app namespace).
+# management-platform-sa has no binding at all in `default` otherwise, and
+# `default` also hosts unrelated live services (cloudops-ingress, jenkins-
+# ingress, stage-navitrends-ingress, etc.) — so this grants ONLY ingress
+# read there, not the full backup ClusterRole, to keep blast radius to
+# exactly what the Application Sites page needs (real domain/TLS lookup).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-ingress-reader-binding
+  namespace: default
+  labels: {owner: ameni-boukattaya, app.kubernetes.io/managed-by: navitrends-pfe-migration}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-ingress-reader-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-sa
+    namespace: management-platform