docs(plan): tick Phase 10.1 satellite ServiceAccount + RBAC

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PLAN.md

@@ -529,7 +529,7 @@ and per-object configuration lives in typed Spec / Status fields.
 - [ ] New `pkg/satellite/controllers/` package wired into the satellite agent. Reconcilers for Resource (filtered by `Spec.NodeName == cfg.NodeName`), ResourceDefinition (parent lookup, no own reconcile), Snapshot (filtered by `Spec.Nodes ∋ cfg.NodeName`), StoragePool (filtered by `Spec.NodeName == cfg.NodeName`).
 - [ ] Resource reconciler on satellite replaces the gRPC `ApplyResources` consumer with a native CRD watch. On reconcile: read Resource Spec + parent RD + peers (List by RD-name) + Node info + effective DRBD options (resolver re-runs satellite-side, reading RG via apiserver) → drive `pkg/satellite/reconciler.applyOne` (existing logic, lifted out from the gRPC handler).
 - [ ] DeleteResource flow: on Resource with non-zero `DeletionTimestamp` + the satellite's own finalizer, satellite runs the existing teardown (`drbdadm down` → `DeleteVolume` → `rm .res` → `cryptsetup luksClose`) then strips its own finalizer. Today's controller-side `runDelete` (`internal/controller.ResourceReconciler.runDelete`) goes away — finalizer ownership transfers to the satellite.
-- [ ] ServiceAccount + RBAC manifests: satellite needs `get/list/watch` on RD/Resource/Snapshot/Node/StoragePool/ResourceGroup, `update/patch` on its own Resources (Spec + finalizer), `update/patch` on `*/status` subresources for observed-state writes.
+- [x] ServiceAccount + RBAC manifests (2026-05-10). `config/rbac/satellite_role.yaml` defines the ClusterRole + ServiceAccount + binding the satellite needs once Phase 10.1 promotes it to a controller-runtime manager: read-only on RG/RD/Node/Snapshot/ControllerConfig; read+write on Resource (own finalizer); write on `*/status` subresources via SSA from Phase 10.2; full CRUD on PhysicalDevice (discovery+delete-on-attach); read on Secrets in the controller namespace; emit Events; per-node leader-election Leases. Wired into `config/rbac/kustomization.yaml`. Dormant until the satellite-as-controller-runtime code lands.
 
 ### 10.2 — Status is the only home for observed state