fix(helm): enforce automountServiceAccountToken on all pod specs; fix leading --- in serviceaccount.yaml

- gateway/backend deployments: add explicit automountServiceAccountToken on
  the pod spec so serviceAccounts.*.automount is honoured regardless of
  whether the SA is chart-created or operator-supplied (previously the flag
  only took effect on the SA object when create: true, creating an asymmetry
  with the UI which already enforced it at pod-spec level)
- serviceaccount.yaml: use a $prev sentinel to emit --- only between
  documents, preventing a leading --- when gateway SA is skipped but
  backend or ui SA is created (avoids lint/GitOps warnings from strict
  YAML parsers and tools like ArgoCD)

https://claude.ai/code/session_01QPy362WnjmEpeNuJaPUqmF

helm/litellm/templates/backend/deployment.yaml

@@ -20,6 +20,7 @@ spec:
         {{- include "litellm.backend.selectorLabels" . | nindent 8 }}
     spec:
       serviceAccountName: {{ include "litellm.backend.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.serviceAccounts.backend.automount }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}

helm/litellm/templates/gateway/deployment.yaml

@@ -23,6 +23,7 @@ spec:
         {{- include "litellm.gateway.selectorLabels" . | nindent 8 }}
     spec:
       serviceAccountName: {{ include "litellm.gateway.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.serviceAccounts.gateway.automount }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}

helm/litellm/templates/serviceaccount.yaml

@@ -1,4 +1,6 @@
+{{- $prev := false -}}
 {{- if .Values.serviceAccounts.gateway.create -}}
+{{- $prev = true }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -13,7 +15,10 @@ metadata:
 automountServiceAccountToken: {{ .Values.serviceAccounts.gateway.automount }}
 {{- end }}
 {{- if .Values.serviceAccounts.backend.create }}
+{{- if $prev }}
 ---
+{{- end }}
+{{- $prev = true }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -28,7 +33,9 @@ metadata:
 automountServiceAccountToken: {{ .Values.serviceAccounts.backend.automount }}
 {{- end }}
 {{- if .Values.serviceAccounts.ui.create }}
+{{- if $prev }}
 ---
+{{- end }}
 apiVersion: v1
 kind: ServiceAccount
 metadata: