fix(backup-system): kubectl via ServiceAccount in-cluster, no kubeconfig del host

El k3s.yaml del host apunta a 127.0.0.1:6443 (inalcanzable desde el pod).
El script antiguo solo funcionaba porque su KUBECONFIG apuntaba a un
fichero inexistente y kubectl caia en fallback al SA. Se hace explicito:
unset KUBECONFIG + RBAC con apps/deployments,statefulsets get (para
kubectl exec deploy/...) y se retira el mount del kubeconfig.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backup-system/clusterrole-backup.yaml

@@ -13,3 +13,11 @@ rules:
       - get
       - list
       - create
+  # kubectl exec deploy/<nombre> resuelve el Deployment antes de elegir pod
+  - apiGroups: ["apps"]
+    resources:
+      - deployments
+      - statefulsets
+    verbs:
+      - get
+      - list

backup-system/configmap-backup-scripts.yaml

@@ -8,6 +8,12 @@ data:
     # (→ alerta Grafana homelab-backup-job-failed → Telegram).
     set -u
 
+    # kubectl usa el ServiceAccount in-cluster (backup-sa + ClusterRole backup-role).
+    # NO usar el k3s.yaml del host: su server es https://127.0.0.1:6443, inalcanzable
+    # desde la red del pod (el script antiguo "funcionaba" porque apuntaba KUBECONFIG
+    # a un fichero inexistente y kubectl caía en fallback al ServiceAccount).
+    unset KUBECONFIG
+
     BACKUP_DIR="/data/backups/backups"
     DATE=$(date +%Y-%m-%d_%H-%M-%S)
     STORAGE=/var/lib/rancher/k3s/storage

backup-system/cronjob-backup.yaml

@@ -28,9 +28,6 @@ spec:
             # en Docker Hub ya no son fiables (migración Broadcom/bitnamilegacy)
             image: docker.io/bitnami/kubectl@sha256:558420daf32bbc382e3e9af4537f4073085b336ddd47399a3b70e70087115978
             command: ["/bin/bash", "/scripts/backup.sh"]
-            env:
-            - name: KUBECONFIG
-              value: /kubeconfig/k3s.yaml
             resources:
               requests:
                 cpu: 200m
@@ -49,8 +46,6 @@ spec:
               mountPath: /scripts
             - name: k3s-storage
               mountPath: /var/lib/rancher/k3s/storage
-            - name: kubeconfig
-              mountPath: /kubeconfig/k3s.yaml
             - name: k3s-db
               mountPath: /data/k3s-db
               readOnly: true
@@ -84,10 +79,6 @@ spec:
             hostPath:
               path: /var/lib/rancher/k3s/storage
               type: Directory
-          - name: kubeconfig
-            hostPath:
-              path: /etc/rancher/k3s/k3s.yaml
-              type: File
           - name: k3s-db
             hostPath:
               path: /var/lib/rancher/k3s/server/db