sec(#1528): provision tb_meta + tb_ingest service-account Secrets (S1)

[aptracebloc]

What & why

Chart side of backend#1528 S1 (RFC-0003 D10 close-out), paired with tracebloc/client-runtime#290. jobs-manager mints two dedicated, single-database MySQL identities (tb_meta, tb_ingest) to replace the root-equivalent edgeuser; this PR wires the Secrets + env they read.

• values: serviceDbAccounts (default false) + optional tbMetaPassword / tbIngestPassword operator pins, mirroring perExperimentDbCreds / credmgrPassword. Added to values.schema.json.
• secrets.yaml: TB_META_PASSWORD / TB_INGEST_PASSWORD via the same generate-once, upgrade-stable 3-tier resolution as TB_CREDMGR_PASSWORD (operator pin → existing Secret value → randAlphaNum), with alphanumeric-pin validation. Emitted only when serviceDbAccounts is on.
• jobs-manager-deployment: SERVICE_DB_ACCOUNTS=1 + TB_META_USER/TB_INGEST_USER + the two secretKeyRef passwords, rendered only when the flag is on.

Safety

Gated so a default install is byte-identical — verified with helm template: flag off renders none of the new keys; flag on renders the Secret keys (pins decode correctly) and the deployment env. The mirrored node-agents Secret intentionally does not carry the service creds.

Tests

helm unittest ./client — secrets_test.yaml + jobs_manager_test.yaml extended (49 assertions across the two suites, green). (5 pre-existing failures in other suites are a local helm-unittest 1.1.2 / helm v4 vs CI-pinned 0.5.2 artifact, present on clean develop too — not touched here.)

Merge coordination

Safe in any order with #290: the env only exists when serviceDbAccounts=true, and the runtime mint is inert until the env is present. Neither is enabled by default.

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are flag-gated and additive; default installs render no new secrets or env. Password handling mirrors the existing credmgr pattern with no runtime consumer switch in this PR alone.

Overview
backend#1528 S1 (RFC-0003 D10 close-out) wires chart support for dedicated MySQL service identities tb_meta and tb_ingest, paired with client-runtime minting. Everything is behind serviceDbAccounts (default false) so a normal install stays byte-identical.

When the flag is on, secrets.yaml adds TB_META_PASSWORD and TB_INGEST_PASSWORD using the same 3-tier resolution as TB_CREDMGR_PASSWORD (operator pin → existing Secret → randAlphaNum), with alphanumeric validation on tbMetaPassword / tbIngestPassword. jobs-manager-deployment gets SERVICE_DB_ACCOUNTS=1, fixed usernames, and secretKeyRef for both passwords.

values.yaml, values.schema.json, and chart version 1.9.28 document the knobs. helm unittest covers default-off rendering and flag-on Secret/env wiring.

^{Reviewed by Cursor Bugbot for commit 6bdf91f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 37b151b. Configure here.}