fix(vault-gke): relax topology spread to ScheduleAnyway while SSD quota is exhausted

vault-1 and vault-2 are stuck Pending because GCE quota (SSD_TOTAL_GB 500/500)
prevents new nodes from provisioning. ScheduleAnyway lets them land in any zone
that has capacity while the quota increase request is pending.

Also adds ESO Workload Identity IAM bindings to Terraform state (previously applied
out-of-band via gcloud; now tracked in cloud-sql.tf).

servers/gcp/cloud-sql.tf

@@ -236,6 +236,24 @@ resource "google_secret_manager_secret_iam_member" "gitea_db_password_accessor"
   member    = "serviceAccount:${google_service_account.gitea.email}"
 }
 
+# ESO Workload Identity — allows the external-secrets controller SA on GKE
+# to impersonate the gitea GCP SA for Secret Manager access.
+resource "google_service_account_iam_member" "eso_gitea_wi" {
+  service_account_id = google_service_account.gitea.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "serviceAccount:${var.project_id}.svc.id.goog[external-secrets/external-secrets]"
+
+  depends_on = [google_container_cluster.neuron_platform]
+}
+
+resource "google_service_account_iam_member" "eso_gitea_token_creator" {
+  service_account_id = google_service_account.gitea.name
+  role               = "roles/iam.serviceAccountTokenCreator"
+  member             = "serviceAccount:${var.project_id}.svc.id.goog[external-secrets/external-secrets]"
+
+  depends_on = [google_container_cluster.neuron_platform]
+}
+
 output "gitea_service_account_email" {
   description = "Gitea GKE SA email — used in the Workload Identity annotation"
   value       = google_service_account.gitea.email

servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml

@@ -90,7 +90,7 @@ spec:
           topologySpreadConstraints:
             - maxSkew: 1
               topologyKey: topology.kubernetes.io/zone
-              whenUnsatisfiable: DoNotSchedule
+              whenUnsatisfiable: ScheduleAnyway
               labelSelector:
                 matchLabels:
                   app.kubernetes.io/name: vault