What action should I hook into when adding roles and capabilities?

When adding a role and capabilities you only need to run the code once since the roles and capabilities are saved to the database when using add_role or ->add_cap functions so just like Andy said you can use after_setup_theme for this kind of action but add some kind of check so it only runs once, like register_activation_hook or using options:

add_action('after_setup_theme','my_add_role_function');

function my_add_role_function(){
    $roles_set = get_option('my_roles_are_set');
    if(!$roles_set){
        add_role('my_role', 'my_roleUser', array(
            'read' => true, // True allows that capability, False specifically removes it.
            'edit_posts' => true,
            'delete_posts' => true,
            'upload_files' => true 
        ));
        update_option('my_roles_are_set',true);
    }
}