fix: update service account parent refs on user rename in embedded IAM

The embedded IAM UpdateUser handler updated group membership but
not service account ParentUser fields, unlike the standalone handler.

weed/s3api/s3api_embedded_iam.go

@@ -361,6 +361,12 @@ func (e *EmbeddedIamApi) UpdateUser(s3cfg *iam_pb.S3ApiConfiguration, values url
 						}
 					}
 				}
+				// Update service account parent references
+				for _, sa := range s3cfg.ServiceAccounts {
+					if sa.ParentUser == userName {
+						sa.ParentUser = newUserName
+					}
+				}
 				return resp, nil
 			}
 		}