home-assistant: split Role for InfluxDB-token Secret RBAC

Token Job hit `secrets is forbidden: ... cannot create resource` even
though the Role listed `create` in verbs. Kubernetes RBAC rejects
`create` verbs combined with `resourceNames` — at creation time the
resource doesn't yet exist by name, so the rule never matches.

Standard pattern: split into two rules — blanket `create` on Secrets
in the namespace (creating any other Secret is the only collateral
damage, and there's no other actor with this SA), plus resourceNames-
restricted `get/update/patch` on the single named `ha-influxdb-token`
Secret. Job now creates on first run and updates in place on later
runs.

kubernetes/seed/influxdb/ha-token-job.yaml

@@ -29,10 +29,17 @@ metadata:
   name: ha-influxdb-token-writer
   namespace: home-assistant
 rules:
+  # `create` cannot be combined with resourceNames — the resource
+  # doesn't exist yet at creation time. Split into two rules: blanket
+  # `create` on Secrets in the namespace, then resourceNames-restricted
+  # `get/update/patch` on the single token Secret.
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["create"]
   - apiGroups: [""]
     resources: ["secrets"]
     resourceNames: ["ha-influxdb-token"]
-    verbs: ["get", "create", "update", "patch"]
+    verbs: ["get", "update", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding