Rebuild catalog-mcp consumer groups on the real 5-role model

KongConsumerGroups were still named sttlab-user/sttlab-admin, a leftover
from before the classic-models realm's role model existed. Real users'
JWTs carry realm roles (admin, read_only, product_manager, customer,
support) via consumer_groups_claim, so no group ever matched and every
tool call was rejected with 403 "consumer groups were not found".

Groups now match the realm roles directly; tool ACLs gate on each role's
catalog:read/catalog:write grant from security-model.yaml.

kong/mcp/ai-mcp-proxy.yaml

@@ -18,8 +18,11 @@ config:
         open_world_hint: false
       acl:
         allow:
-          - sttlab-user
+          - admin
-          - sttlab-admin
+          - read_only
+          - product_manager
+          - customer
+          - support
       method: GET
       scheme: http
       host: ${REST_HOSTNAME}
@@ -34,8 +37,11 @@ config:
         open_world_hint: false
       acl:
         allow:
-          - sttlab-user
+          - admin
-          - sttlab-admin
+          - read_only
+          - product_manager
+          - customer
+          - support
       method: GET
       scheme: http
       host: ${REST_HOSTNAME}
@@ -56,7 +62,8 @@ config:
         open_world_hint: false
       acl:
         allow:
-          - sttlab-admin
+          - admin
+          - product_manager
       method: POST
       scheme: http
       host: ${REST_HOSTNAME}

kong/mcp/consumergroups.yaml

@@ -1,23 +1,59 @@
 apiVersion: configuration.konghq.com/v1beta1
 kind: KongConsumerGroup
 metadata:
-  name: ${NAME}-sttlab-user
+  name: ${NAME}-admin
   namespace: ${NAMESPACE}
 spec:
   controlPlaneRef:
     type: konnectNamespacedRef
     konnectNamespacedRef:
       name: ${CONTROL_PLANE_REF_NAME}
-  name: sttlab-user
+  name: admin
 ---
 apiVersion: configuration.konghq.com/v1beta1
 kind: KongConsumerGroup
 metadata:
-  name: ${NAME}-sttlab-admin
+  name: ${NAME}-read_only
   namespace: ${NAMESPACE}
 spec:
   controlPlaneRef:
     type: konnectNamespacedRef
     konnectNamespacedRef:
       name: ${CONTROL_PLANE_REF_NAME}
-  name: sttlab-admin
+  name: read_only
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-product_manager
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: product_manager
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-customer
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: customer
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-support
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: support