fix: role last-used tracking, and record S3 requests in last-used metadata

Role last-used tracking was missing entirely - `GetRole` returned a `RoleLastUsed` element that nothing ever wrote, rendering the zero time instead of the empty element AWS returns for an unused role - and access key last-used only ever saw the `IAM`/`STS` control plane, so a credential used exclusively against the S3 gateway reported as never used. Roles now record a use whenever a request authenticates with one of their session credentials, through a new `Storer.RecordRoleUsage` mirroring `RecordAccessKeyUsage`, gated on the session's role still being the one it was minted against so a session outliving its role can't attribute its use to a same-named replacement. `LastUsedDate` became a `*time.Time` so an unused role renders as an empty element.

Both records now cover the S3 data plane as well: the gateway sends its configured region and `s3` on evaluate-policy and the IAM service records the caller there, so `GetAccessKeyLastUsed's` `ServiceName` is now iam, sts or s3. That call was chosen over derive-signing-key, which runs before signature verification and takes its region and service from the caller's own `Authorization` header - recording there would let anyone who knows an access key id refresh and poison another identity's audit record. Requests denied by a bucket policy or made against a public bucket are not recorded, since neither reaches identity-policy evaluation. To keep per-request recording affordable, an update is skipped while the stored record has the same service and region and is under a minute old; a change of either is written through immediately.

Assuming a role is not a use, a request denied by an identity policy is, and both successful and denied S3 requests update the record. Also moves the `OIDC-dependent` tests into the `s3-iam-session` group so runoidctests.sh runs a single group.

auth/iam.go

@@ -212,6 +212,7 @@ type Opts struct {
 	StandaloneDefaultUserID     int
 	StandaloneDefaultGroupID    int
 	StandaloneDefaultProjectID  int
+	StandaloneRegion            string
 }
 
 func New(o *Opts) (IAMService, error) {
@@ -231,6 +232,7 @@ func New(o *Opts) (IAMService, error) {
 			DefaultUserID:    o.StandaloneDefaultUserID,
 			DefaultGroupID:   o.StandaloneDefaultGroupID,
 			DefaultProjectID: o.StandaloneDefaultProjectID,
+			Region:           o.StandaloneRegion,
 		})
 		if err != nil {
 			return nil, err

auth/iam_standalone.go

@@ -99,6 +99,13 @@ type IAMServiceStandaloneConfig struct {
 	DefaultUserID    int
 	DefaultGroupID   int
 	DefaultProjectID int
+	// Region is the gateway's own configured region, reported to the IAM
+	// service as the region an S3 request was made in when it records the
+	// caller's last-used metadata. It is taken from configuration rather
+	// than from the request's credential scope on purpose: the scope is
+	// attacker-controlled until the signature is verified. Empty disables
+	// the reporting rather than storing a blank region.
+	Region string
 }
 
 // IAMServiceStandalone is the S3 gateway's client for a standalone IAM
@@ -463,6 +470,9 @@ func (s *IAMServiceStandalone) EvaluatePolicy(access, sessionToken string, actio
 		Actions:      actionStrs,
 		Resources:    resources,
 		Condition:    condition,
+		// Reported for last-used metadata only; see EvaluatePolicyRequest.
+		Region:  s.cfg.Region,
+		Service: sigv4auth.ServiceS3,
 	}, &resp)
 	if err != nil {
 		return PolicyEvaluation{}, err