bring unmanaged GCP resources under Terraform

vault-kms.tf: KMS keyring/key for Vault auto-unseal + vault-unseal SA
and IAM bindings — all imported from existing GCP resources.
prevent_destroy=true on the crypto key to protect against accidental deletion.

unmanaged-secrets.tf: 8 secrets that were referenced by live Cloud Run
services but had no TF resource — anthropic-api-key, resend-api-key,
supabase-service-key, docuseal-webhook-token, stripe-price-professional,
stripe-price-founding, stripe-price-family-child, gitea-runner-token.

service-account.tf: 4 manually-created SAs — neuron-workspace-dwd,
docuseal-storage, analytics-reader, harmonic-search-console.

servers/gcp/service-account.tf

@@ -128,3 +128,33 @@ resource "google_cloud_run_v2_service_iam_member" "api_apac_public" {
   role     = "roles/run.invoker"
   member   = "allUsers"
 }
+
+# ── Service accounts brought under Terraform management ───────────────────────
+# Created manually; imported into TF state.
+
+resource "google_service_account" "neuron_workspace_dwd" {
+  account_id   = "neuron-workspace-dwd"
+  display_name = "Neuron Workspace DWD (Gmail access)"
+  description  = "Service account for domain-wide delegation to access neuron@neurontechnologies.ai Gmail"
+  project      = var.project_id
+}
+
+resource "google_service_account" "docuseal_storage" {
+  account_id   = "docuseal-storage"
+  display_name = "DocuSeal Storage"
+  description  = "Storage backend for DocuSeal document signing platform - read/write access to neuron-docuseal-prod bucket only"
+  project      = var.project_id
+}
+
+resource "google_service_account" "analytics_reader" {
+  account_id   = "analytics-reader"
+  display_name = "Analytics Reader"
+  project      = var.project_id
+}
+
+resource "google_service_account" "harmonic_search_console" {
+  account_id   = "harmonic-search-console"
+  display_name = "Harmonic Framework Search Console"
+  description  = "Read-only access to Search Console for harmonic-framework.com"
+  project      = var.project_id
+}