Add ship-status mcp server SA with ci-secret-generator token

clusters/app.ci/ship-status-dash/dashboard/mcp-server-serviceaccount.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mcp-server
+  namespace: ship-status
+  annotations:
+    serviceaccounts.openshift.io/oauth-redirecturi.callback: https://protected-mcp.ship-status.ci.openshift.org/oauth/callback
+  labels:
+    app: dashboard

core-services/ci-secret-bootstrap/_config.yaml

@@ -3350,6 +3350,14 @@ secret_configs:
   - cluster: app.ci
     name: component-monitor-kubeconfigs
     namespace: ship-status
+- from:
+    token:
+      field: sa.mcp-server.app.ci.token.txt
+      item: ship-status-dash-mcp-server
+  to:
+  - cluster: app.ci
+    name: mcp-server-token
+    namespace: ship-status
 - from:
     kubeconfig:
       field: sa.ci-operator.app.ci.config

core-services/ci-secret-generator/_config.yaml

@@ -207,6 +207,15 @@
     - core-ci
     service_account:
     - component-monitor
+- fields:
+  - cmd: oc --kubeconfig /tmp/build-farm-credentials/sa.config-updater.$(cluster).config
+      create token -n ship-status mcp-server --duration=2419200s --bound-object-kind=Secret
+      --bound-object-name=token-bound-object-1
+    name: sa.mcp-server.$(cluster).token.txt
+  item_name: ship-status-dash-mcp-server
+  params:
+    cluster:
+    - app.ci
 - fields:
   - cmd: oc --kubeconfig /tmp/build-farm-credentials/sa.config-updater.$(cluster).config
       create token -n ci $(service_account) --duration=2419200s --bound-object-kind=Secret