feat: add ServiceAccounts for poimen-memory/kmsvc/immich operator Roles

Bind each service's operator Role to a ServiceAccount alongside the
existing oidc:*-admins Group, and wire serviceAccountName into the
pods we control (immich-server, immich-machine-learning,
management-service). poimen-memory's Deployment lives in its own
repo/ArgoCD app, so its SA is created here but not yet wired to a pod.

k8s/apps/immich/deployment.yaml

@@ -19,6 +19,7 @@ spec:
       labels:
         app: immich-server
     spec:
+      serviceAccountName: immich
       nodeSelector:
         kubernetes.io/hostname: talos-cp-3
       containers:
@@ -81,6 +82,7 @@ spec:
       labels:
         app: immich-machine-learning
     spec:
+      serviceAccountName: immich
       containers:
         - name: immich-machine-learning
           image: ghcr.io/immich-app/immich-machine-learning:release