fix: cross-namespace RBAC for local-auth secrets; preserve session key on upgrade (v0.3.3)

[flaccid]

Summary

Fixes HTTP 500 failed to update password when changing a local-auth user password via the UI.

Root cause

The kube-workspaces-local-auth-secrets Role+RoleBinding in the Helm chart was scoped to .Release.Namespace. Password Secrets always live in kube-workspaces-system, so when the chart is installed into a different namespace (e.g. a shared cluster namespace), the API ServiceAccount has no write access to them.

The Kustomize base was already correct — it installs into kube-workspaces-system so the SA and the Secrets share the same namespace.

Changes

Helm rbac.yaml — when auth.localAuth.enabled: true and the release namespace differs from kube-workspaces-system, render a second Role+RoleBinding in kube-workspaces-system. Guarded so it is a no-op for the default (--create-namespace kube-workspaces-system) install path.

Helm auth-secrets.yaml — use lookup to preserve the existing session signing key on helm upgrade. Previously randAlphaNum 32 re-generated a new key on every upgrade, invalidating all active sessions.

Helm tests/rbac_test.yaml — updated to cover the new cross-namespace Role and the document count with localAuth on/off.

Kustomize auth-local/session-secret.yaml — improved generation instructions (no functional change; kustomize base was already correct).

docs/authentication.md — new troubleshooting section for the 500 error with recovery steps and a kubectl auth can-i verification command.

Deploy types affected

Method	Status	Change needed
Helm (same namespace)	✅ already worked	none — the release-ns Role covers it
Helm (shared/different namespace)	❌ 500 on password change	fixed by cross-ns Role
Kustomize base	✅ already worked	none — SA and secrets share kube-workspaces-system
Kustomize auth-local overlay	✅ already worked	session-secret.yaml comment improved
ArgoCD (uses kustomize)	✅ already worked	none
kind (dev cluster, same namespace)	✅ already worked	none