Add the supply account beside the one it replaces

Two at once so the consumer can move without a gap; the old one goes as soon as
it has.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kafka-topology/classic-models.yaml

@@ -92,8 +92,39 @@ spec:
           - Write
           - Describe
 ---
-# The Approvisionnement agent. Reads the catalog topic only — an agent whose job
+# The supply agent. Reads the catalog topic only — an agent whose job is stock
-# is stock has no business reading who paid what.
+# has no business reading who paid what.
+apiVersion: kafka.strimzi.io/v1
+kind: KafkaUser
+metadata:
+  name: classic-models-agent-supply
+  namespace: kafka
+  labels:
+    strimzi.io/cluster: kafka
+spec:
+  authentication:
+    type: scram-sha-512
+  authorization:
+    type: simple
+    acls:
+      - resource:
+          type: topic
+          name: classic-models.catalog
+          patternType: literal
+        operations:
+          - Read
+          - Describe
+      - resource:
+          type: group
+          name: supply-
+          patternType: prefix
+        operations:
+          - Read
+          - Describe
+---
+# The same account under its old French name, kept only until the consumer has
+# moved to the one above. Delete it then — two accounts for one consumer is a
+# second credential nobody is rotating.
 apiVersion: kafka.strimzi.io/v1
 kind: KafkaUser
 metadata: