feat: Kubernetes ServiceAccount auth for gRPC

[wseaton]

Opt-in ServiceAccount auth for the gRPC server. Off by default; existing deployments are unaffected.

• AuthN: verifies the caller's projected ServiceAccount token via the Kubernetes TokenReview API, in-process (no sidecar or mesh).
• AuthZ: exact-match namespace:serviceaccount allowlist.
• Modes off (default) and enforce. enforce fails config validation without a token audience and a non-empty allowlist.
• Health service stays ungated so kubelet probes need no token.
• Verified tokens and definitive rejections are cached (default 60s TTL).
• Rust and Python clients attach the token when a projected token file is present and send nothing otherwise, so the same client works off-cluster against a server with auth off.
• Helm: security.enabled injects the server env and, with serviceAccount.create, binds the SA to system:auth-delegator for TokenReview access.

Config via MODEL_EXPRESS_SECURITY_* env vars or security.* in the config file / Helm values.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[codecov]

Codecov Report

❌ Patch coverage is 71.45791% with 139 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
modelexpress_server/src/auth.rs	24.13%	44 Missing ⚠️
modelexpress_server/src/auth/layer.rs	8.82%	31 Missing ⚠️
modelexpress_server/src/auth/token.rs	81.74%	23 Missing ⚠️
modelexpress_server/src/server.rs	41.17%	20 Missing ⚠️
modelexpress_server/src/config.rs	91.91%	11 Missing ⚠️
modelexpress_client/src/auth.rs	89.36%	10 Missing ⚠️

📢 Thoughts on this report? Let us know!