vad: iam, faas

iam reads django's own postgres credentials (per explicit
instruction - same underlying database), written to its own
apps/iam/postgres vault path via a second dependency-based secrets
entry pointing at the same cluster/db/user as django-postgres. Kafka
and S3 follow the established self-contained/admin-creds patterns.
Also added django_zitadel_access_token to the shared django_auth
extra fields (placeholder, non-functional, only needs to be present).

faas has no vault dependencies at all - namespace only, for regcred.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure.yaml

@@ -742,6 +742,12 @@ environments:
       - name: stamp-verification
         manage: false
         image_pull_secret: true
+      - name: faas
+        manage: false
+        image_pull_secret: true
+      - name: iam
+        manage: false
+        image_pull_secret: true
 
     postgresql:
       default_host: 192.168.8.131
@@ -1067,6 +1073,9 @@ environments:
       - name: transmittal
         acl: private
 
+      - name: iam
+        acl: private
+
     kafka:
       create_acls: false
       kafka_cluster_refs: