#550 @swamp/gcp/iam missing serviceAccounts model type

Problem

The @swamp/gcp/iam extension (v2026.05.26.1) only exposes two model types: roles and policies. It does not cover the GCP IAM Service Accounts API — there is no @swamp/gcp/iam/serviceAccounts type for managing service accounts, keys, or bindings.

This is a significant gap because service account lifecycle (create SA → bind role → generate key → rotate key → delete key) is one of the most common IAM operations, and the current workaround is shelling out to gcloud via command/shell.

Proposed Solution

Add a serviceAccounts model type to @swamp/gcp/iam covering:

• create — iam.serviceAccounts.create
• get / sync — iam.serviceAccounts.get
• update — iam.serviceAccounts.update (display name, description)
• delete — iam.serviceAccounts.delete
• keys.create — iam.serviceAccountKeys.create (generate JSON key)
• keys.list — iam.serviceAccountKeys.list
• keys.delete — iam.serviceAccountKeys.delete

The generated key should be marked as sensitive: true so it flows through swamp's vault-backed secret storage rather than persisting in plaintext.

Alternatives

• Shell out to gcloud iam service-accounts via command/shell (current workaround — not declarative, no drift detection)
• Build a custom @hivemq/gcp/iam/serviceAccounts extension (duplicates what should be official coverage)
• Use terraform for SA lifecycle (works but splits IAM management across two tools)