feat: add poimen-memory-admins group/permissions and k8s RBAC role

Follows the portainer/kmsvc/temporal pattern - group + "permissions"
claim entry only, no Authentik Application/OAuth provider, since
poimen-memory is an internal API-key service, not browser OIDC login.
rock gets it automatically (already in every service_admin_group).

k8s/infra/iam/scripts/authentik-provision.py

@@ -174,6 +174,7 @@ GROUP_PERMISSIONS = {
     "llm-admins": ["llm:read", "llm:write"],
     "paperless-admins": ["paperless:read", "paperless:write"],
     "immich-admins": ["immich:read", "immich:write"],
+    "poimen-memory-admins": ["poimen-memory:read", "poimen-memory:write"],
     "k8s-devops-admin": ["k8s:devops"],
 }
 perms = set()
@@ -265,7 +266,8 @@ homelab_admins = get_or_create(
 SERVICE_ADMIN_GROUP_NAMES = [
     "grafana-admins", "minio-admins", "forgejo-admins", "homarr-admins",
     "portainer-admins", "kmsvc-admins", "temporal-admins", "llm-admins",
-    "paperless-admins", "immich-admins", "k8s-devops-admin",
+    "paperless-admins", "immich-admins", "poimen-memory-admins",
+    "k8s-devops-admin",
 ]
 service_admin_groups = {}
 for group_name in SERVICE_ADMIN_GROUP_NAMES: