Add terraform-ipam CI ServiceAccount (#334)

ServiceAccount `terraform-ipam` in the `woodpecker` namespace for the terraform-ipam pipeline. The Vault k8s auth role `woodpecker_terraform_ipam` (terraform-vault PR) binds it. Mirrors the other terraform-* CI ServiceAccounts and is wired into the woodpecker kustomization.

https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Reviewed-on: #334
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/woodpecker/kustomization.yaml

@@ -12,6 +12,7 @@ resources:
   - serviceaccount_terraform_authentik.yaml
   - serviceaccount_terraform_enc.yaml
   - serviceaccount_terraform_git.yaml
+  - serviceaccount_terraform_ipam.yaml
   - serviceaccount_terraform_prowlarr.yaml
   - serviceaccount_terraform_rancher.yaml
   - serviceaccount_terraform_radarr.yaml

apps/base/woodpecker/serviceaccount_terraform_ipam.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: terraform-ipam
+  namespace: woodpecker