svcforge: reference implementation

Complete working build of the system learn-python/ teaches.
164 tests, mypy --strict clean, domain coverage 99%.

deploy/chart/templates/serviceaccount.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.serviceAccount.create }}
+{{/*
+One ServiceAccount per service, not one shared. The api talks only to Postgres and has no
+Kubernetes rights at all; giving it the worker's identity would hand an
+internet-facing HTTP surface the ability to create namespaces.
+*/}}
+{{- range $component := list "api" "worker" "reconciler" }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "svcforge.serviceAccountName" (dict "ctx" $ "component" $component) }}
+  labels:
+    {{- include "svcforge.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: {{ $component }}
+  {{- with $.Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+# The api never calls the API server, so it gets no token. The worker and reconciler both
+# shell out to helm, which needs one.
+automountServiceAccountToken: {{ ne $component "api" }}
+{{- end }}
+{{- end }}