feat: add poimen-memory-admins group/permissions and k8s RBAC role

Follows the portainer/kmsvc/temporal pattern - group + "permissions"
claim entry only, no Authentik Application/OAuth provider, since
poimen-memory is an internal API-key service, not browser OIDC login.
rock gets it automatically (already in every service_admin_group).

k8s/infra/rbac/kustomization.yaml

@@ -14,6 +14,7 @@ resources:
   - kmsvc-operator-role.yaml
   - temporal-operator-role.yaml
   - llm-serving-operator-role.yaml
+  - poimen-memory-operator-role.yaml
 # paperless's Role/RoleBinding lives in k8s/apps/paperless/rbac.yaml instead -
 # that app already has its own kustomization + namespace, no need to
 # duplicate it here. All of these stay inert (grant nothing) until

k8s/infra/rbac/poimen-memory-operator-role.yaml

@@ -0,0 +1,33 @@
+# Scoped operator access for poimen-memory-admins: the poimen-memory
+# deployment + its own config/secrets only. memory-db-* (CNPG-managed) and
+# poimen-git-info/poimen-secrets-* (owned by poimen's own repo/ArgoCD app,
+# not this one) are excluded. Inert until kube-apiserver's OIDC wiring lands
+# (--oidc-groups-claim=groups, --oidc-groups-prefix=oidc:).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: poimen-memory-operator
+  namespace: poimen
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    resourceNames: ["poimen-memory"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames: ["poimen-memory-api-key", "poimen-memory-secrets"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: poimen-memory-admins-binding
+  namespace: poimen
+subjects:
+  - kind: Group
+    name: "oidc:poimen-memory-admins"
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: Role
+  name: poimen-memory-operator
+  apiGroup: rbac.authorization.k8s.io