Clean up SA keys used as workaround for payment-jobs and ftp-poller GCP pubsub access

Background:
During April 2026, an incident required SA keys to be created as deployment workarounds:

#33222 — ftp-poller deployment issue; SA key sa-api created as workaround
#33223 — payment-jobs unable to publish to activity and account mailer queues; SA key sa-job created as workaround. Multiple PRs were required due to instability (2369 revert gcp config → 2376 revert of revert → 2371 permission check tester)

Goal:
Remove the temporary SA keys once the underlying GCP Workload Identity / IAM configuration is confirmed stable

AC:
Feature branch created for the cleanup
Regression run in dev confirming payment-jobs can publish to AUTH_EVENT_TOPIC and ACCOUNT_MAILER_TOPIC without SA keys
ftp-poller deployment confirmed working without SA key
PR 2355 merged after regression passes
Anish (Patel) notified once keys are safe to delete

Related:
[#33222](https://github.com/bcgov/entity/issues/33222), [#33223](https://github.com/bcgov/entity/issues/33223)
PRs: [#2355](https://github.com/bcgov/sbc-pay/pull/2355), [#2369](https://github.com/bcgov/sbc-pay/pull/2369) [#2371](https://github.com/bcgov/sbc-pay/pull/2371), [#2376](https://github.com/bcgov/sbc-pay/pull/2376), [#2385](https://github.com/bcgov/sbc-pay/pull/2385)