fix: role last-used tracking, and record S3 requests in last-used metadata

Role last-used tracking was missing entirely - `GetRole` returned a `RoleLastUsed` element that nothing ever wrote, rendering the zero time instead of the empty element AWS returns for an unused role - and access key last-used only ever saw the `IAM`/`STS` control plane, so a credential used exclusively against the S3 gateway reported as never used. Roles now record a use whenever a request authenticates with one of their session credentials, through a new `Storer.RecordRoleUsage` mirroring `RecordAccessKeyUsage`, gated on the session's role still being the one it was minted against so a session outliving its role can't attribute its use to a same-named replacement. `LastUsedDate` became a `*time.Time` so an unused role renders as an empty element.

Both records now cover the S3 data plane as well: the gateway sends its configured region and `s3` on evaluate-policy and the IAM service records the caller there, so `GetAccessKeyLastUsed's` `ServiceName` is now iam, sts or s3. That call was chosen over derive-signing-key, which runs before signature verification and takes its region and service from the caller's own `Authorization` header - recording there would let anyone who knows an access key id refresh and poison another identity's audit record. Requests denied by a bucket policy or made against a public bucket are not recorded, since neither reaches identity-policy evaluation. To keep per-request recording affordable, an update is skipped while the stored record has the same service and region and is under a minute old; a change of either is written through immediately.

Assuming a role is not a use, a request denied by an identity policy is, and both successful and denied S3 requests update the record. Also moves the `OIDC-dependent` tests into the `s3-iam-session` group so runoidctests.sh runs a single group.

iamapi/storage/vault.go

@@ -820,10 +820,19 @@ func (s *VaultStore) recordAccessKeyUsage(ctx context.Context, accessKeyID, serv
 		if err != nil {
 			continue
 		}
-		if !slices.ContainsFunc(user.AccessKeys, func(k types.AccessKeyEntry) bool { return k.AccessKeyId == accessKeyID }) {
+		idx := slices.IndexFunc(user.AccessKeys, func(k types.AccessKeyEntry) bool { return k.AccessKeyId == accessKeyID })
+		if idx == -1 {
 			continue
 		}
 
+		// The user was just read, so the redundant-update check costs
+		// nothing here and saves the read-modify-write below on every
+		// request after the first within the coalescing window.
+		key := user.AccessKeys[idx]
+		if !shouldRecordUsage(key.LastUsedDate, key.LastUsedService, key.LastUsedRegion, service, region, when) {
+			return nil
+		}
+
 		_, err = s.withUserCAS(ctx, username, func(u *types.User) error {
 			for i, key := range u.AccessKeys {
 				if key.AccessKeyId == accessKeyID {
@@ -1202,6 +1211,51 @@ func (s *VaultStore) UpdateAssumeRolePolicy(ctx context.Context, input UpdateAss
 	})
 }
 
+// recordRoleUsageTimeout bounds RecordRoleUsage's detached background
+// update, the way recordAccessKeyUsageTimeout does for access keys.
+const recordRoleUsageTimeout = 5 * time.Second
+
+// RecordRoleUsage updates roleName's RoleLastUsed metadata in its own
+// background goroutine, detached from ctx, and always returns nil
+// immediately — for the same reasons RecordAccessKeyUsage does: it runs on
+// the hot path of every request authenticated with a session credential,
+// and the metadata is purely informational, so a Vault round trip (plus a
+// CAS retry loop) must not be charged to the request, and a lost or failed
+// update is only logged.
+func (s *VaultStore) RecordRoleUsage(_ context.Context, roleName, region string, when time.Time) error {
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), recordRoleUsageTimeout)
+		defer cancel()
+		if err := s.recordRoleUsage(ctx, roleName, region, when); err != nil {
+			debuglogger.Logf("failed to record Vault role last-used metadata for %q: %v", roleName, err)
+		}
+	}()
+	return nil
+}
+
+func (s *VaultStore) recordRoleUsage(ctx context.Context, roleName, region string, when time.Time) error {
+	role, _, err := s.readRoleVersion(roleName)
+	if err != nil {
+		return err
+	}
+
+	// A redundant update is dropped after the read, before the far more
+	// expensive read-modify-write — see shouldRecordUsage.
+	prev, prevRegion := roleLastUsedRecord(*role)
+	if !shouldRecordUsage(prev, "", prevRegion, "", region, when) {
+		return nil
+	}
+
+	_, err = s.withRoleCAS(ctx, roleName, func(role *types.Role) error {
+		role.RoleLastUsed = &types.RoleLastUsed{
+			LastUsedDate: &when,
+			Region:       region,
+		}
+		return nil
+	})
+	return err
+}
+
 func (s *VaultStore) TagRole(ctx context.Context, roleName string, tags []types.Tag) error {
 	_, err := s.withRoleCAS(ctx, roleName, func(role *types.Role) error {
 		merged, err := mergeTags(role.Tags, tags, iamutil.TagKeysFolded)