fix(chart/webapp): render webapp.service.annotations on the Service object (PLT-900)

The upstream chart's webapp Service template renders `labels` but never
renders `annotations` from `webapp.service.annotations`. That makes the
value silently inert, blocking platforms (e.g. Palantir Rubix on
FedStart) that mint per-Service TLS certs from a Service annotation —
`com.palantir.rubix.service/pod-cert: "{}"` would have no effect, so
`cert-<fullname>-webapp` never gets minted and the nginx-tls sidecar
fails to mount it.

Add the standard `{{- with .Values.webapp.service.annotations }}` block
on the webapp Service, mirroring how every other Service template in
this chart (electric, supervisor, the bitnami subcharts) already exposes
`service.annotations`. Default to `{}` in values.yaml so the field is
discoverable.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ConProgramming

hosting/k8s/helm/templates/webapp.yaml

@@ -490,6 +490,10 @@ metadata:
   labels:
     {{- $component := "webapp" }}
     {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
+  {{- with .Values.webapp.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   type: {{ .Values.webapp.service.type }}
   ports:

hosting/k8s/helm/values.yaml

@@ -577,6 +577,7 @@ electric:
     type: ClusterIP
     port: 3000
     targetPort: 3000
+    annotations: {}
   resources: {}
 
   # Health probe configuration