Follows the portainer/kmsvc/temporal pattern - group + "permissions" claim entry only, no Authentik Application/OAuth provider, since poimen-memory is an internal API-key service, not browser OIDC login. rock gets it automatically (already in every service_admin_group).