chore(services): rename services/provisioning -> services/platform-api

O.0 prep from OPERATOR-PLAN.md. Mechanical refactor before adding partner
management and operator-specific endpoints. The service now owns more than
just provisioning orchestration (it'll soon own partners, tenant lifecycle
actions, multi-audience JWT validation), so the name 'platform-api' reflects
its scope better.

What changed:
- Directory: services/provisioning/ -> services/platform-api/
- Package: @dezky/provisioning -> @dezky/platform-api
- Docker: container_name dezky-provisioning -> dezky-platform-api;
  compose service key 'provisioning' -> 'platform-api'; volume
  provisioning_node_modules -> platform_api_node_modules
- Portal: PROVISIONING_INTERNAL_URL env var -> PLATFORM_API_INTERNAL_URL,
  default URL http://provisioning:3001 -> http://platform-api:3001 in all
  three proxy routes (me.get.ts, tenants/index.post.ts, tenants/[slug]/
  reconcile.post.ts), plus NUXT_API_BASE updated
- Health endpoint service identifier and main.ts log lines updated to
  'dezky-platform-api'
- Docs swept: README, CLAUDE.md, SERVICES.md, AUTHENTIK-SETUP.md,
  NEXT-STEPS.md, TROUBLESHOOTING.md, OPERATOR-PLAN.md, traefik/dynamic.yml

What deliberately stays:
- Internal module names ProvisioningService / ProvisioningModule (those
  describe an orchestration sub-concern, not the service's purpose)
- Tenant.provisioningStatus / provisioningErrors field names (state
  per integration, not service name)
- File services/platform-api/src/tenants/provisioning.service.ts
- 'Hetzner provisioning' references in production-prep docs (infrastructure
  provisioning, unrelated)

Verified end-to-end after rename: /api/me returns 200 with profile + 2
tenants + subscription, /api/tenants/dezky/reconcile returns 200 with
Authentik integration still ok.

OPERATOR-PLAN.md O.0 checkboxes ticked.

CLAUDE.md

@@ -27,7 +27,7 @@ All components are Apache 2.0 / MIT licensed for clean commercial multi-tenant h
 | OCIS | `owncloud/ocis:7.0` | File storage (S3-compatible backend) | `https://files.dezky.local` |
 | Collabora | `collabora/code:latest` | Office document editor inside OCIS | `https://office.dezky.local` |
 | Portal stub | (built from `./apps/portal`) | Nuxt 3 customer portal | `https://app.dezky.local` |
-| Provisioning | (built from `./services/provisioning`) | NestJS provisioning worker | (internal, port 3001) |
+| Platform API | (built from `./services/platform-api`) | NestJS service · tenants/partners/users/provisioning orchestration | `api.dezky.local` (+ internal port 3001) |
 
 **NOT included in this dev setup** (added in later phases):
 - Jitsi Meet (4-5 sub-containers — see `docker-compose.optional.yml` when ready)
@@ -65,7 +65,7 @@ dezky/
 ├── apps/
 │   └── portal/                            # Nuxt 3 portal (stub for now)
 ├── services/
-│   └── provisioning/                      # NestJS worker (stub for now)
+│   └── platform-api/                      # NestJS service · platform control plane
 ├── packages/                              # Shared TypeScript packages (empty for now)
 ├── infrastructure/
 │   └── docker-compose/
@@ -226,8 +226,8 @@ See `docs/TROUBLESHOOTING.md` for detailed solutions.
 ## After local dev works
 
 1. Build out the Nuxt portal (`apps/portal`) — start with auth flow via Authentik OIDC
-2. Build the provisioning service (`services/provisioning`) — first endpoint: create tenant
-3. Wire portal → provisioning → Authentik/OCIS/Stalwart admin APIs
+2. Build the platform API (`services/platform-api`) — first endpoint: create tenant
+3. Wire portal → platform-api → Authentik/OCIS/Stalwart admin APIs
 4. Add Zulip + Jitsi when ready (`docker-compose.optional.yml`)
 5. When portal MVP is solid → migrate to Hetzner AX41 production