Grant the deploy pipeline configmaps and batch/cronjobs

apps/limesurvey introduced the first ConfigMap and CronJob in this repo, and
CI's server-side dry-run failed on both:

  configmaps "limesurvey-db-config" is forbidden
  cronjobs.batch "limesurvey-db-backup" is forbidden

The ClusterRole grants exactly the resource kinds this repo contains, so it
needed to grow with the repo. Applied out-of-band by an admin as the file's
header requires -- this is deliberately not part of the root kustomization, so
the pipeline cannot widen its own permissions.

secrets remain denied; verified after applying.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rbac/gitea-deployer.yaml

@@ -10,6 +10,7 @@
 # socktop-webterm pipeline uses).
 #
 # Deliberately granted: the resource kinds this repo contains, cluster-wide.
+# configmaps and batch/cronjobs added 2026-09-21 for apps/limesurvey.
 # Deliberately NOT granted: secrets (app secrets are created out-of-band),
 # RBAC objects, nodes, or delete on anything.
 apiVersion: rbac.authorization.k8s.io/v1
@@ -23,6 +24,10 @@ rules:
       - persistentvolumes
       - persistentvolumeclaims
       - services
+      - configmaps
+    verbs: [get, list, watch, create, update, patch]
+  - apiGroups: [batch]
+    resources: [cronjobs, jobs]
     verbs: [get, list, watch, create, update, patch]
   - apiGroups: [apps]
     resources: [deployments]