Fix ServiceAccount override, add standard labels, document values.yaml

[aaronmgn]

Summary

Chart cleanup with one real bugfix: a bring-your-own ServiceAccount was silently ignored. The rest adds the standard Kubernetes labels to every rendered resource, fails early when required operator CRDs are missing, and fully comments values.yaml.

Details

• Both StatefulSets now set serviceAccountName when serviceAccount.nameOverride is set with create: false. Previously the guard only checked create, so pods fell back to the namespace default ServiceAccount and the override was ignored.
• Resources that rendered without any labels (the ConfigMaps, AWS gp3 StorageClass, cert-manager Issuer, MongoDBCommunity resource, fallback Deployment/Service, and both Role/RoleBinding pairs) now include the graylog.labels helper, so helm.sh/chart, app.kubernetes.io/name, instance, and managed-by appear on everything the release owns.
• Added app.kubernetes.io/component labels (server, datanode, mongodb, forwarder, default-backend) next to the legacy app: labels. No selector was changed, so this is upgrade-safe. The nonstandard app.kubernetes.io/app-name label on the datanode Service is kept and marked deprecated so existing external selectors (ServiceMonitors etc.) keep matching.
• The MongoDBCommunity and Issuer templates now fail at install time with an instructive error when the required operator CRDs are absent, instead of a raw API error. Offline renders (helm template, helm-unittest) skip the check.
• Every property in values.yaml now has a comment, each starting with the property name. The values themselves are untouched: both versions were parsed and compared, and they are semantically identical.
• Four new unit tests pin the ServiceAccount behavior (positive and negative cases for both StatefulSets).

Linked issues

Related to #120: the unused datanode persistence fields it describes are now documented as inert in values.yaml, but this PR does not remove or implement them. No issue exists for the ServiceAccount override bug fixed here; it surfaced during review.

PR Checklist

Please check the items that apply to your change.

• Tests added/updated
• Documentation updated
• This PR includes a new feature
• This PR includes a bugfix
• This PR includes a refactor

Testing Checklist

Static Validation

• Linter check passes: helm lint ./charts/graylog
• Helm renders local template sucessfully: helm template graylog ./charts/graylog --validate

Installation

• Fresh installation completes successfully: helm install graylog ./charts/graylog
• All pods reach Running state: kubectl rollout status statefulset/graylog
• Helm tests pass: helm test graylog

Functional (if applicable)

• Web UI accessible and login works
• DataNodes visible in System > Cluster Configuration
• Inputs can be created and receive data

Upgrade (if applicable)

• Upgrade from previous release succeeds
• Scaling up/down works correctly
• Configuration changes apply correctly

Specific to this PR

• All 148 helm-unittest tests pass (4 new). I rendered the chart with provider=aws, ingress, and plugins enabled and checked every resulting resource for the chart labels with a small script. I also parsed values.yaml against main to confirm no value changed, and had the diff independently reviewed by a second AI reviewer (OpenAI Codex); its findings are addressed in the review-fix commits.
• Deployed end to end on minikube (6GB/4CPU, MongoDB Kubernetes Operator 1.6.1): fresh install, all pods ready, all 5 helm test suites pass, API login with generated credentials works, indexer health green. Two deviations from defaults were needed for the local environment, both now filed as follow-ups: mongodb.version=7.0.25 (the CI overlay's 8.0.23 cannot start on Linux kernel 6.19+, upstream SERVER-121912) and graylog.livenessProbe.enabled=false for first boot (the default probe can kill Graylog mid-provisioning and permanently wedge the cluster; needs a startupProbe). The CRD fail-fast check from this PR was also verified live: installing without the operator produces the new actionable error.
• The new CRD check was additionally exercised in its skip path (offline helm template renders fine without a cluster).

Notes for reviewers

• Verify all applicable tests above pass
• Validate that the linked issues are no longer reproducible, if applicable
• Sync up with the author before merging
• The commit history should be preserved - use rebase-merge or standard merge options when applicable

Heads up for the upgrade path: the new pod-template labels trigger one rolling restart of both StatefulSets on the first upgrade. No StatefulSet, Deployment, or Service selector changed, so there is no immutable-field conflict. The app: selector migration to app.kubernetes.io/component was deliberately left out; selectors are immutable, so that belongs in a major version.

[alix-graylog]

This is great, something we didn't scope out for this milestone, but definitely should have!