masterone: pin storageClassName empty on hostPath PVCs (default-SC injection fix)

clusters/default/masterone/10-postgres.yaml

@@ -1,5 +1,7 @@
 # PostgreSQL for the MasterOne portal (hostPath PV — single-node local cluster;
 # data persists on the host under /root/rancher/data/masterone/postgres).
+# NOTE: Longhorn migration pending — Longhorn volumes fail to attach on this
+# nested-docker node (iscsid lifetime issue). hostPath is the working config.
 apiVersion: v1
 kind: PersistentVolume
 metadata:
@@ -21,6 +23,7 @@ metadata:
 spec:
   accessModes: [ReadWriteOnce]
   volumeName: masterone-postgres-pv
+  storageClassName: ""
   resources:
     requests:
       storage: 10Gi

clusters/default/masterone/20-portal.yaml

@@ -1,6 +1,6 @@
-# MasterOne portal app. Image is built and imported locally (masterone-portal:k8s);
-# uploads persist on hostPath PV. Secrets (API keys, DB creds, PORTAL_SECRET_KEY)
-# live in the masterone-secrets Secret — created imperatively, NEVER committed to git.
+# MasterOne portal app. Image built/imported locally (masterone-portal:k8s);
+# uploads on hostPath PV. Secrets from OpenBao (synced to masterone-secrets by
+# /root/openbao/sync-openbao.sh).
 apiVersion: v1
 kind: PersistentVolume
 metadata:
@@ -22,6 +22,7 @@ metadata:
 spec:
   accessModes: [ReadWriteOnce]
   volumeName: masterone-uploads-pv
+  storageClassName: ""
   resources:
     requests:
       storage: 10Gi
@@ -43,6 +44,7 @@ spec:
       labels:
         app: portal
     spec:
+      serviceAccountName: portal-sa
       containers:
         - name: portal
           image: masterone-portal:k8s