fix: MQTTAuth device lookup by Spec.DeviceID + PG15+ GRANT (v0.2.5)

- MQTTAuth: replaced Get(Name=deviceID) with List+filter by Spec.DeviceID
  (K8s object name != deviceID — caused deny for all devices)
- EnsureTenantDB: added GRANT role TO CURRENT_USER before CREATE DATABASE OWNER
  (PG15+ requires SET ROLE privileges for target owner)
- Image: naeel/iot-operator:v0.2.5
- E2E test passed: device create → MQTT publish → SQS → Postgres → REST API

internal/api/handler/iot_device_handler.go

@@ -193,10 +193,21 @@ func (h *Handler) MQTTAuth(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Проверяем что IoTDevice активно
-	device := &iotv1alpha1.IoTDevice{}
-	if err := h.K8s.Get(r.Context(), client.ObjectKey{Namespace: ns, Name: deviceID}, device); err != nil {
-		// IoTDevice не найден (или удалён) — deny
+	// Ищем IoTDevice по Spec.DeviceID (имя K8s объекта может отличаться от deviceID)
+	deviceList := &iotv1alpha1.IoTDeviceList{}
+	if err := h.K8s.List(r.Context(), deviceList, client.InNamespace(ns)); err != nil {
+		writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
+		return
+	}
+	var device *iotv1alpha1.IoTDevice
+	for i := range deviceList.Items {
+		if deviceList.Items[i].Spec.DeviceID == deviceID {
+			device = &deviceList.Items[i]
+			break
+		}
+	}
+	if device == nil {
+		// IoTDevice с таким deviceID не найден — deny
 		writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
 		return
 	}