Add serviceAccountName to Kubernetes config schema

Surfaces the serviceAccountName field in the adapter UI under the
Kubernetes group. The job manifest builder already reads this field;
this change makes it configurable via the UI.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperclip-adapter-opencode-k8s",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "description": "Paperclip adapter plugin that runs OpenCode agents as Kubernetes Jobs",
   "license": "MIT",
   "type": "module",

src/server/config-schema.ts

@@ -160,6 +160,13 @@ export function getConfigSchema(): AdapterConfigSchema {
         hint: "When a running Job for the same task is found after a server restart, reattach (stream logs and await completion) instead of blocking",
         group: "Kubernetes",
       },
+      {
+        key: "serviceAccountName",
+        label: "Service Account",
+        type: "text",
+        hint: "Kubernetes ServiceAccount name for the Job pod; defaults to the namespace 'default' SA. Use a dedicated SA (e.g. paperclip-developer) when the Job needs API access.",
+        group: "Kubernetes",
+      },
 
       // Operational fields (timeoutSec and graceSec are provided by the platform)
     ],