Add a scoped newsletter API user for the scheduled campaign task

Token is generated once and kept in Secret listmonk-newsletter-api.
Tested: create, test-send and schedule work; subscribers/settings 403.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -53,6 +53,46 @@
     wait: true
     wait_timeout: "{{ listmonk_wait_timeout }}"
 
+- name: Read the newsletter automation credentials
+  kubernetes.core.k8s_info:
+    kubeconfig: "{{ listmonk_kubeconfig | default(omit, true) }}"
+    context: "{{ listmonk_kube_context | default(omit, true) }}"
+    kind: Secret
+    namespace: "{{ listmonk_namespace }}"
+    name: "{{ listmonk_name }}-newsletter-api"
+  register: _listmonk_newsletter_secret
+  no_log: true
+  when: listmonk_newsletter_api_enabled | bool
+
+# Generated once, then reused; delete the Secret to rotate the token.
+- name: Use or generate the newsletter automation token
+  ansible.builtin.set_fact:
+    listmonk_newsletter_api_token: >-
+      {{ (_listmonk_newsletter_secret.resources[0].data.token | b64decode)
+         if _listmonk_newsletter_secret.resources | length > 0
+         else lookup('ansible.builtin.password', '/dev/null', chars=['ascii_letters', 'digits'], length=48) }}
+  no_log: true
+  when: listmonk_newsletter_api_enabled | bool
+
+- name: Store the newsletter automation credentials
+  kubernetes.core.k8s:
+    kubeconfig: "{{ listmonk_kubeconfig | default(omit, true) }}"
+    context: "{{ listmonk_kube_context | default(omit, true) }}"
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: "{{ listmonk_name }}-newsletter-api"
+        namespace: "{{ listmonk_namespace }}"
+      type: Opaque
+      stringData:
+        url: "{{ listmonk_root_url }}"
+        username: "{{ listmonk_newsletter_api_user }}"
+        token: "{{ listmonk_newsletter_api_token }}"
+  no_log: true
+  when: listmonk_newsletter_api_enabled | bool
+
 # Settings, Dex admins and lists live in listmonk's database, not its config.
 - name: Converge database-held configuration
   kubernetes.core.k8s_exec: