feat: add CI ServiceAccount + RBAC for Tekton PipelineRun access

CI runner (Forgejo DinD) runs jobs as Docker containers — no in-cluster
SA token available. Industry standard: dedicated SA with minimal RBAC,
long-lived token as KUBECONFIG_B64 secret in Forgejo.

SA: ci-tekton-trigger (namespace: api)
Permissions: create/get/watch/delete PipelineRuns, get TaskRuns, get pod logs
Token: kubernetes.io/service-account-token secret

k8s/tekton/ci-rbac.yaml

@@ -0,0 +1,51 @@
+# ServiceAccount and RBAC for CI runner to create/watch Tekton PipelineRuns.
+# Applied to the `api` namespace where PipelineRuns execute.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ci-tekton-trigger
+  namespace: api
+  labels:
+    app: api-gateway
+    component: ci
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ci-tekton-trigger
+  namespace: api
+rules:
+- apiGroups: ["tekton.dev"]
+  resources: ["pipelineruns"]
+  verbs: ["create", "get", "list", "watch", "delete"]
+- apiGroups: ["tekton.dev"]
+  resources: ["taskruns"]
+  verbs: ["get", "list"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ci-tekton-trigger
+  namespace: api
+subjects:
+- kind: ServiceAccount
+  name: ci-tekton-trigger
+  namespace: api
+roleRef:
+  kind: Role
+  name: ci-tekton-trigger
+  apiGroup: rbac.authorization.k8s.io
+---
+# Secret to generate a long-lived token for the CI runner.
+# The runner mounts this as KUBECONFIG_B64 or uses it directly.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-tekton-trigger-token
+  namespace: api
+  annotations:
+    kubernetes.io/service-account.name: ci-tekton-trigger
+type: kubernetes.io/service-account-token

k8s/tekton/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 namespace: api
 
 resources:
+- ci-rbac.yaml
 - task-integration-test.yaml
 - pipeline-integration-test.yaml