helm: say what the Lance worker needs from security.toml (#12489)

* helm: say what the Lance worker needs from security.toml

Since #12470 the Lance namespace authenticates weed-worker by a token
derived from jwt.filer_signing.key, which the chart renders only with
securityConfig.jwtSigning.filerWrite. Without it, a gateway with
identities lists the worker no tables, and the lance_* jobs silently
find nothing to do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK

* helm: warn that filerWrite also requires signed filer HTTP writes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

k8s/charts/seaweedfs/values.yaml

@@ -1744,6 +1744,14 @@ worker:
 
   # The lance_* jobs run in their own container, /usr/bin/weed-worker.
   # amd64/arm64 only; pin mixed clusters with worker.affinity/nodeSelector.
+  # It keeps tables through the filers the masters list and reads
+  # security.toml. The Lance namespace knows it by a token derived from
+  # jwt.filer_signing.key, which the chart renders only with
+  # global.seaweedfs.securityConfig.jwtSigning.filerWrite: true. When S3 has
+  # identities, set it, or the namespace lists the worker no tables and the
+  # lance_* jobs find nothing to do. It also makes the filer accept only signed
+  # HTTP writes, so clients writing to the filer's HTTP API directly need a JWT
+  # signed with that key.
 
   # Lance namespace URL override; empty derives it from s3.lancePort.
   namespaceUrl: ""