ghp: use the estate templated default Vault convention

Drop the bespoke ghp SA/role/policy (terraform-vault#120 closed). The default
k8s auth role, bound to SA default in every namespace, already has a templated
read grant on kv/kubernetes/namespace/<ns>/default/*, so ghp needs zero
terraform-vault change.

- Remove the custom ServiceAccount; run as the namespace default SA.
- Deployment + migrate Job: serviceAccountName default.
- VaultAuth: role/serviceAccount default (mirrors artifactapi).
- VaultStaticSecrets: source paths move to the templated location
  kubernetes/namespace/ghp/default/{github-app,app}; Secret names unchanged.

apps/base/ghp/deployment.yaml

@@ -23,7 +23,7 @@ spec:
       labels:
         app: ghp
     spec:
-      serviceAccountName: ghp
+      serviceAccountName: default
       automountServiceAccountToken: true
       securityContext:
         runAsNonRoot: true