Let the instance service account list a team's deadman switches

GET /api/teams/{id}/deadman/switches used requireTeamMember, which 404s
for the instance-scoped service account because it belongs to no team.
terdut-operator lists switches by name on every reconcile, so TerdutTeams
never became ready. Instance service accounts now pass, as they already do
for the write endpoints.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/api/teams.go

@@ -826,7 +826,10 @@ func handleListTeamDeadman(db *sql.DB) http.HandlerFunc {
 		if !ok {
 			return
 		}
-		if !requireTeamMember(w, r, teamID) {
+		// The operator's instance-scoped account reconciles the switches by name,
+		// so it has to read them without being a member: that is owner reach,
+		// the same as the writes below, and still reads no incidents.
+		if !isInstanceServiceAccount(r.Context()) && !requireTeamMember(w, r, teamID) {
 			return
 		}