Add ServiceAccount, Role, and RoleBinding so the api-gateway pod can list/get/watch pods and pod metrics in the foxhunt namespace. Also sets serviceAccountName on the Deployment to bind the new SA. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>