Rebuild catalog-mcp consumer groups on the real 5-role model

KongConsumerGroups were still named sttlab-user/sttlab-admin, a leftover
from before the classic-models realm's role model existed. Real users'
JWTs carry realm roles (admin, read_only, product_manager, customer,
support) via consumer_groups_claim, so no group ever matched and every
tool call was rejected with 403 "consumer groups were not found".

Groups now match the realm roles directly; tool ACLs gate on each role's
catalog:read/catalog:write grant from security-model.yaml.

kong/mcp/ai-mcp-proxy.yaml

@@ -18,8 +18,11 @@ config:
         open_world_hint: false
       acl:
         allow:
-          - sttlab-user
-          - sttlab-admin
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
       method: GET
       scheme: http
       host: ${REST_HOSTNAME}
@@ -34,8 +37,11 @@ config:
         open_world_hint: false
       acl:
         allow:
-          - sttlab-user
-          - sttlab-admin
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
       method: GET
       scheme: http
       host: ${REST_HOSTNAME}
@@ -56,7 +62,8 @@ config:
         open_world_hint: false
       acl:
         allow:
-          - sttlab-admin
+          - admin
+          - product_manager
       method: POST
       scheme: http
       host: ${REST_HOSTNAME}