Add read-only RBAC for management-platform cluster-view SA

ServiceAccount management-platform-viewer-sa (in management-platform ns),
ClusterRole management-platform-viewer-role (get/list/watch on pods,
services, deployments.apps only - no secrets, no write verbs), and a
RoleBinding per app namespace (n8n, odoo, mautic, erpnext, nextcloud,
jenkins-agents, jenkins, management-platform). Already applied to the
live cluster and verified via kubectl auth can-i; committing here for
source-of-truth tracking.

management-platform-viewer-rbac.yaml

@@ -0,0 +1,159 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: management-platform-viewer-sa
+  namespace: management-platform
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: management-platform-viewer-role
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "services"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: n8n
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: odoo
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: mautic
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: erpnext
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: nextcloud
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: jenkins-agents
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: jenkins
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: management-platform
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform