masterone: pin storageClassName empty on hostPath PVCs (default-SC injection fix)

clusters/default/masterone/20-portal.yaml

@@ -1,6 +1,6 @@
-# MasterOne portal app. Image is built and imported locally (masterone-portal:k8s);
-# uploads persist on hostPath PV. Secrets (API keys, DB creds, PORTAL_SECRET_KEY)
-# live in the masterone-secrets Secret — created imperatively, NEVER committed to git.
+# MasterOne portal app. Image built/imported locally (masterone-portal:k8s);
+# uploads on hostPath PV. Secrets from OpenBao (synced to masterone-secrets by
+# /root/openbao/sync-openbao.sh).
 apiVersion: v1
 kind: PersistentVolume
 metadata:
@@ -22,6 +22,7 @@ metadata:
 spec:
   accessModes: [ReadWriteOnce]
   volumeName: masterone-uploads-pv
+  storageClassName: ""
   resources:
     requests:
       storage: 10Gi
@@ -43,6 +44,7 @@ spec:
       labels:
         app: portal
     spec:
+      serviceAccountName: portal-sa
       containers:
         - name: portal
           image: masterone-portal:k8s