feat: add ServiceAccounts for poimen-memory/kmsvc/immich operator Roles

Bind each service's operator Role to a ServiceAccount alongside the
existing oidc:*-admins Group, and wire serviceAccountName into the
pods we control (immich-server, immich-machine-learning,
management-service). poimen-memory's Deployment lives in its own
repo/ArgoCD app, so its SA is created here but not yet wired to a pod.

k8s/apps/immich/rbac.yaml

@@ -3,6 +3,11 @@
 # provisioning-managed (immich-oidc). Same pattern as
 # k8s/apps/paperless/rbac.yaml. Inert until kube-apiserver's OIDC wiring
 # lands (--oidc-groups-claim=groups, --oidc-groups-prefix=oidc:).
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: immich
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -29,6 +34,9 @@ subjects:
   - kind: Group
     name: "oidc:immich-admins"
     apiGroup: rbac.authorization.k8s.io
+  - kind: ServiceAccount
+    name: immich
+    namespace: immich
 roleRef:
   kind: Role
   name: immich-operator