Give management-platform a scoped ServiceAccount for k8s backup/restore

The pod running app.py had no kubectl binary and only a read-only SA
(management-platform-viewer-sa) — backup-k8s-apps.sh/restore-k8s-apps.sh
could never actually run from inside it. Adds:

- management-platform-backup-role (ClusterRole, bound via RoleBinding only
  in n8n/odoo/mautic/nextcloud/erpnext — not cluster-wide): get/list/watch
  on pods/deployments/configmaps/ingresses/PVCs, pods/exec create, pods
  create+delete (needed for restore's populate-before-scale-up loader pod),
  secrets get/list/update/patch, deployments/scale update/patch only (no
  write on full Deployment/Service/ConfigMap/Ingress specs).
- management-platform-sa, replacing management-platform-viewer-sa as the
  pod's identity — inherits the old viewer-role's read-only bindings too
  (retargeted in management-platform-viewer-rbac.yaml) so the existing
  cluster-view page keeps working under one SA.
- k3s binary hostPath-mounted read-only into the pod (same pattern as the
  Jenkins agent's docker-cli container), so `k3s kubectl` is available
  where no separate kubectl binary exists.

Both scripts updated to fall back to k3s kubectl when no kubectl is on
PATH, and to use /proc/meminfo instead of `free` for the resource-safety
check (not present in the pod's minimal image). Also fixes a real issue
found while live-testing this from inside the pod: the pod's pre-existing
/root hostPath mount also exposes the host's own admin ~/.kube/config,
which k3s kubectl was silently preferring over the scoped SA token —
forcing --kubeconfig=/dev/null in both scripts closes that.

Verified end-to-end from inside the actual management-platform pod:
manifests/secret/DB-dump/PVC-data backup for n8n succeeds under the new
SA's scoped permissions, and a kube-system access attempt is correctly
rejected (Forbidden) once the kubeconfig leak is closed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

management-platform-viewer-rbac.yaml

@@ -1,12 +1,3 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: management-platform-viewer-sa
-  namespace: management-platform
-  labels:
-    owner: ameni-boukattaya
-    app.kubernetes.io/managed-by: navitrends-pfe-migration
----
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -36,7 +27,7 @@ roleRef:
   name: management-platform-viewer-role
 subjects:
   - kind: ServiceAccount
-    name: management-platform-viewer-sa
+    name: management-platform-sa
     namespace: management-platform
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -53,7 +44,7 @@ roleRef:
   name: management-platform-viewer-role
 subjects:
   - kind: ServiceAccount
-    name: management-platform-viewer-sa
+    name: management-platform-sa
     namespace: management-platform
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -70,7 +61,7 @@ roleRef:
   name: management-platform-viewer-role
 subjects:
   - kind: ServiceAccount
-    name: management-platform-viewer-sa
+    name: management-platform-sa
     namespace: management-platform
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -87,7 +78,7 @@ roleRef:
   name: management-platform-viewer-role
 subjects:
   - kind: ServiceAccount
-    name: management-platform-viewer-sa
+    name: management-platform-sa
     namespace: management-platform
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -104,7 +95,7 @@ roleRef:
   name: management-platform-viewer-role
 subjects:
   - kind: ServiceAccount
-    name: management-platform-viewer-sa
+    name: management-platform-sa
     namespace: management-platform
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -121,7 +112,7 @@ roleRef:
   name: management-platform-viewer-role
 subjects:
   - kind: ServiceAccount
-    name: management-platform-viewer-sa
+    name: management-platform-sa
     namespace: management-platform
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -138,7 +129,7 @@ roleRef:
   name: management-platform-viewer-role
 subjects:
   - kind: ServiceAccount
-    name: management-platform-viewer-sa
+    name: management-platform-sa
     namespace: management-platform
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -155,5 +146,5 @@ roleRef:
   name: management-platform-viewer-role
 subjects:
   - kind: ServiceAccount
-    name: management-platform-viewer-sa
+    name: management-platform-sa
     namespace: management-platform