authentik/temporal DB users+databases were never provisioned (old helmfile hook gone; db-init-job only made schemas in shared app DB). Adds managed.roles (authentik/temporal login roles, passwords from basic-auth secrets) + Database CRs (dedicated DBs owned by each role). Role secrets applied out-of-band (SOPS), not in kustomize resources so data-schemas app doesn't choke on ciphertext.