Add terraform-ipam CI ServiceAccount

ServiceAccount for the terraform-ipam Woodpecker pipeline (Vault k8s auth role
woodpecker_terraform_ipam binds it), mirroring the other terraform-* runners.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/base/woodpecker/kustomization.yaml

@@ -12,6 +12,7 @@ resources:
   - serviceaccount_terraform_authentik.yaml
   - serviceaccount_terraform_enc.yaml
   - serviceaccount_terraform_git.yaml
+  - serviceaccount_terraform_ipam.yaml
   - serviceaccount_terraform_prowlarr.yaml
   - serviceaccount_terraform_rancher.yaml
   - serviceaccount_terraform_radarr.yaml

apps/base/woodpecker/serviceaccount_terraform_ipam.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: terraform-ipam
+  namespace: woodpecker