feat(infra): RBAC for api_gateway pod listing

Add ServiceAccount, Role, and RoleBinding so the api-gateway pod can
list/get/watch pods and pod metrics in the foxhunt namespace. Also sets
serviceAccountName on the Deployment to bind the new SA.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/services/api-gateway.yaml

@@ -26,6 +26,7 @@ spec:
         app.kubernetes.io/name: api-gateway
         app.kubernetes.io/part-of: foxhunt
     spec:
+      serviceAccountName: api-gateway
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
@@ -145,3 +146,39 @@ spec:
     - port: 9091
       targetPort: 9091
       name: metrics
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: api-gateway
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/name: api-gateway
+    app.kubernetes.io/part-of: foxhunt
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: api-gateway-pod-reader
+  namespace: foxhunt
+rules:
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [get, list, watch]
+  - apiGroups: [metrics.k8s.io]
+    resources: [pods]
+    verbs: [get, list]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: api-gateway-pod-reader
+  namespace: foxhunt
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: api-gateway-pod-reader
+subjects:
+  - kind: ServiceAccount
+    name: api-gateway
+    namespace: foxhunt