- MQTTAuth: replaced Get(Name=deviceID) with List+filter by Spec.DeviceID (K8s object name != deviceID — caused deny for all devices) - EnsureTenantDB: added GRANT role TO CURRENT_USER before CREATE DATABASE OWNER (PG15+ requires SET ROLE privileges for target owner) - Image: naeel/iot-operator:v0.2.5 - E2E test passed: device create → MQTT publish → SQS → Postgres → REST API