fix: MQTTAuth device lookup by Spec.DeviceID + PG15+ GRANT (v0.2.5)

- MQTTAuth: replaced Get(Name=deviceID) with List+filter by Spec.DeviceID
  (K8s object name != deviceID — caused deny for all devices)
- EnsureTenantDB: added GRANT role TO CURRENT_USER before CREATE DATABASE OWNER
  (PG15+ requires SET ROLE privileges for target owner)
- Image: naeel/iot-operator:v0.2.5
- E2E test passed: device create → MQTT publish → SQS → Postgres → REST API

internal/storage/iotpg/iot_telemetry_store.go

@@ -126,6 +126,13 @@ func (s *IoTPostgresStore) EnsureTenantDB(ctx context.Context, namespace string)
 			return fmt.Errorf("iotpg: create user %s: %w", userName, err)
 		}
 
+		// PG15+: GRANT role TO current_user перед CREATE DATABASE ... OWNER
+		if _, err = s.adminDB.ExecContext(ctx,
+			fmt.Sprintf(`GRANT %s TO CURRENT_USER`, userName),
+		); err != nil {
+			return fmt.Errorf("iotpg: grant role %s: %w", userName, err)
+		}
+
 		// CREATE DATABASE нельзя в транзакции
 		if _, err = s.adminDB.ExecContext(ctx,
 			fmt.Sprintf(`CREATE DATABASE %s OWNER %s`, dbName, userName),