feat: add S3 and SQS permissions to service accounts and capability groups

- New capability groups: s3-users, s3-writers, sqs-users, sqs-writers
- portfolio-agent: add s3:read, sqs:read
- memory-agent: add s3:read, s3:write, sqs:read, sqs:write
- Enables portfolio and memory services to access MinIO S3 and message queues via JWT

scripts/iam/authentik-provision.py

@@ -185,6 +185,10 @@ GROUP_PERMISSIONS = {
     "llm-users": ["llm:inference"],
     "memory-users": ["memory:read"],
     "memory-writers": ["memory:read", "memory:write"],
+    "s3-users": ["s3:read"],
+    "s3-writers": ["s3:read", "s3:write"],
+    "sqs-users": ["sqs:read"],
+    "sqs-writers": ["sqs:read", "sqs:write"],
 }
 perms = set()
 for group in request.user.groups.all():
@@ -806,7 +810,7 @@ print("\n[SERVICE ACCOUNTS] Creating service accounts for API access...")
 # Format: "<api>:<action>" e.g. "llm:inference", "memory:write"
 SERVICE_ACCOUNTS = {
     "portfolio-agent": {
-        "roles": ["llm:inference", "memory:read"],
+        "roles": ["llm:inference", "memory:read", "s3:read", "sqs:read"],
         "attributes": {
             "memory_projects": ["homelab", "portfolio"],
             "memory_visibility": "public",
@@ -815,7 +819,7 @@ SERVICE_ACCOUNTS = {
         "secret_name": "portfolio-agent-oidc",
     },
     "memory-agent": {
-        "roles": ["llm:inference", "memory:read", "memory:write"],
+        "roles": ["llm:inference", "memory:read", "memory:write", "s3:read", "s3:write", "sqs:read", "sqs:write"],
         "attributes": {
             "memory_projects": ["*"],
             "memory_visibility": "private",