fix(backup-system): kubectl via ServiceAccount in-cluster, no kubeconfig del host

El k3s.yaml del host apunta a 127.0.0.1:6443 (inalcanzable desde el pod).
El script antiguo solo funcionaba porque su KUBECONFIG apuntaba a un
fichero inexistente y kubectl caia en fallback al SA. Se hace explicito:
unset KUBECONFIG + RBAC con apps/deployments,statefulsets get (para
kubectl exec deploy/...) y se retira el mount del kubeconfig.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backup-system/cronjob-backup.yaml

@@ -28,9 +28,6 @@ spec:
             # en Docker Hub ya no son fiables (migración Broadcom/bitnamilegacy)
             image: docker.io/bitnami/kubectl@sha256:558420daf32bbc382e3e9af4537f4073085b336ddd47399a3b70e70087115978
             command: ["/bin/bash", "/scripts/backup.sh"]
-            env:
-            - name: KUBECONFIG
-              value: /kubeconfig/k3s.yaml
             resources:
               requests:
                 cpu: 200m
@@ -49,8 +46,6 @@ spec:
               mountPath: /scripts
             - name: k3s-storage
               mountPath: /var/lib/rancher/k3s/storage
-            - name: kubeconfig
-              mountPath: /kubeconfig/k3s.yaml
             - name: k3s-db
               mountPath: /data/k3s-db
               readOnly: true
@@ -84,10 +79,6 @@ spec:
             hostPath:
               path: /var/lib/rancher/k3s/storage
               type: Directory
-          - name: kubeconfig
-            hostPath:
-              path: /etc/rancher/k3s/k3s.yaml
-              type: File
           - name: k3s-db
             hostPath:
               path: /var/lib/rancher/k3s/server/db