feat: add Redpanda and wp-deploy-coordinator to Legion

- Redpanda single-node StatefulSet in platform namespace
- wp-coordinator deployment consuming wp.deploy topic
- RBAC for coordinator to exec into harmonic-wordpress pods
- R2 credentials via ExternalSecret (no SSH key needed on coordinator)
- Sites config as ConfigMap — add new WP sites without code changes

servers/legion/k8s/wp-coordinator/rbac.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: wp-coordinator
+  namespace: platform
+---
+# Allow wp-coordinator to exec into pods and list pods in harmonic-wordpress
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: wp-coordinator
+  namespace: harmonic-wordpress
+rules:
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [get, list]
+  - apiGroups: [""]
+    resources: [pods/exec]
+    verbs: [create]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: wp-coordinator
+  namespace: harmonic-wordpress
+subjects:
+  - kind: ServiceAccount
+    name: wp-coordinator
+    namespace: platform
+roleRef:
+  kind: Role
+  name: wp-coordinator
+  apiGroup: rbac.authorization.k8s.io