fix(rbac): grant frontend read access to PurchaseRequest + RegistrationRequest

[bussyjd]

Summary

Adds two read-only RBAC rules to the frontend ClusterRole so /api/marketplace/purchases and registration-status badges work without 403s.

Bug discovered during validation

Running the bundle (#536) deployment + visiting /marketplace/purchases produced:

Failed to list PurchaseRequests

Frontend pod logs:

code: 403,
message: 'purchaserequests.obol.org is forbidden:
  User "system:serviceaccount:obol-frontend:obol-frontend" cannot list
  resource "purchaserequests" in API group "obol.org" at the cluster scope'

The existing ClusterRole (obol-frontend-openclaw-discovery) granted CRUD on ServiceOffers but nothing for PurchaseRequests or RegistrationRequests — both of which the marketplace UI lists cluster-wide for the "purchases paying to this wallet" and "ERC-8004 registered" badges.

Fix

- apiGroups: ["obol.org"]
  resources: ["purchaserequests", "purchaserequests/status"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["obol.org"]
  resources: ["registrationrequests", "registrationrequests/status"]
  verbs: ["get", "list", "watch"]

Read-only is sufficient: the agent owns PurchaseRequest writes via the buy-x402 skill; the controller owns RegistrationRequest writes.

Stack

Stacked on feat/marketplace-bundle (#536) where internal/embed/infrastructure/base/templates/obol-frontend.yaml lives. Merge after #536.

Test plan

• go build clean
• go test ./internal/embed/... green
• Verified on a live cluster: applied an out-of-band ClusterRole with the same rules → /api/marketplace/purchases returns 200, My Purchases page renders rows with chevron drawer expansion (validated via Chrome MCP).
• Reviewer: after merge, redeploy and confirm 'kubectl auth can-i list purchaserequests --as=system:serviceaccount:obol-frontend:obol-frontend' returns yes

[bussyjd]

Closing as superseded by #541, which has now been merged into feat/marketplace-bundle. #541 includes the frontend PurchaseRequest/RegistrationRequest read permissions and also removes the duplicate frontend RBAC template, so merging this older stacked patch would be redundant.