feat(base): pass cloudwatch service account annotations for IRSA support

[davidf-null]

What

Adds a new input cloudwatch_service_account_annotations (map(string), default {}) to the nullplatform/base module and renders it into the base chart's cloudwatch.serviceAccount.annotations.

The block is rendered only when cloudwatch_enabled is true and the map is non-empty, so nothing changes for existing consumers.

Why

The base chart's logs controller runs under the nullplatform-pod-metadata-reader-sa ServiceAccount. Until now that SA carried no annotations and there was no way to pass any through this module, so on EKS the controller could only reach CloudWatch via the node instance role (broad, node-wide privilege).

With this change you can set eks.amazonaws.com/role-arn on the SA and use IRSA — a scoped IAM role for just the logs controller — instead of granting CloudWatch to every pod on the node.

Requires the matching helm-charts change (cloudwatch.serviceAccount.annotations on the base chart): https://github.com/nullplatform/helm-charts (branch feature/cloudwatch-irsa-sa-annotations).

Changes

• variables.tf — new cloudwatch_service_account_annotations variable
• locals.tf — pass the map into templatefile()
• templates/nullplatform_base_values.tmpl.yaml — conditional serviceAccount.annotations block
• README.md — inputs table + AI metadata entry

Usage

module "base" {
  # ...
  cloudwatch_enabled = true
  cloudwatch_service_account_annotations = {
    "eks.amazonaws.com/role-arn" = "arn:aws:iam::<account-id>:role/<role-name>"
  }
}

Testing

• Rendered the template block in isolation (map with role-arn → correct indentation; empty map → no serviceAccount block).
• tofu fmt clean.
• BEGIN_AI_METADATA JSON re-validated after the README edit.

🤖 Generated with Claude Code