iam: add memory scope, service accounts, manual provisioning

- Add 'memory' scope property mapping (memory_projects, memory_visibility, memory_role)
- Add capability groups: llm-users, memory-users, memory-writers
- Add service account provisioning for portfolio-agent, memory-agent
- Fix sops-secrets kustomization (generatorOptions)
- Add RoleBindings for portfolio, poimen, dashboard namespaces
- Remove PostSync hook - IAM provisioning is now manual-only

k8s/argocd/secrets/kustomization.yaml

@@ -1,9 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-secretGenerator:
-  - name: portfolio-secrets
-    namespace: portfolio
-    disableNameSuffixHash: true
-    envs:
-      - portfolio-secrets.enc.env
+# Disable hash suffix for all generated secrets (stable names)
+generatorOptions:
+  disableNameSuffixHash: true
+
+# SOPS-encrypted secrets via ksops generator
+generators:
+  - secret-generator.yaml