iam: add queue oauth2 provider + temporal-worker queue access

- Added queue OAuth2 provider (pk=13, client_id=queue-sqs)
- Added client_credentials grant type to all OAuth2 providers
- Updated temporal-worker-agent service account:
  - Added queue:send role
  - Added sqs_queues=* claim
- Provisioning script now creates 6 OAuth2 providers (all complete)
- All groups, scopes, and service accounts ready for Phase 2

Updated 2026-09-12 in provision-rbac.py

scripts/iam/provision-rbac.py

@@ -133,9 +133,10 @@ SERVICE_ACCOUNTS: Dict[str, Dict[str, Any]] = {
     },
     "temporal-worker-agent": {
         "description": "Temporal workflow worker",
-        "roles": ["llm:inference", "workflow:execute", "memory:read", "memory:write"],
+        "roles": ["llm:inference", "workflow:execute", "memory:read", "memory:write", "queue:send"],
         "claims": {
             "memory_projects": ["*"],
+            "sqs_queues": ["*"],
             "authorized_models": ["reasoning", "ornith:35b", "qwen2.5:3b"],
         },
     },
@@ -290,6 +291,7 @@ OAuth2_PROVIDERS = {
     "poimen": {"client_id": "poimen", "redirect_uris": ["http://localhost:3000/callback", "https://poimen.riotpiao.com/callback"]},
     "paperless": {"client_id": "paperless", "redirect_uris": ["http://localhost:8000/auth/complete", "https://paperless.riotpiao.com/auth/complete"]},
     "grafana": {"client_id": "grafana", "redirect_uris": ["http://localhost:3000/login/generic_oauth", "https://grafana.riotpiao.com/login/generic_oauth"]},
+    "queue": {"client_id": "queue-sqs", "redirect_uris": ["http://localhost:8080/callback", "https://queue.riotpiao.com/callback"]},
 }
 
 for provider_name, provider_spec in OAuth2_PROVIDERS.items():