chore(services): rename services/provisioning -> services/platform-api

O.0 prep from OPERATOR-PLAN.md. Mechanical refactor before adding partner
management and operator-specific endpoints. The service now owns more than
just provisioning orchestration (it'll soon own partners, tenant lifecycle
actions, multi-audience JWT validation), so the name 'platform-api' reflects
its scope better.

What changed:
- Directory: services/provisioning/ -> services/platform-api/
- Package: @dezky/provisioning -> @dezky/platform-api
- Docker: container_name dezky-provisioning -> dezky-platform-api;
  compose service key 'provisioning' -> 'platform-api'; volume
  provisioning_node_modules -> platform_api_node_modules
- Portal: PROVISIONING_INTERNAL_URL env var -> PLATFORM_API_INTERNAL_URL,
  default URL http://provisioning:3001 -> http://platform-api:3001 in all
  three proxy routes (me.get.ts, tenants/index.post.ts, tenants/[slug]/
  reconcile.post.ts), plus NUXT_API_BASE updated
- Health endpoint service identifier and main.ts log lines updated to
  'dezky-platform-api'
- Docs swept: README, CLAUDE.md, SERVICES.md, AUTHENTIK-SETUP.md,
  NEXT-STEPS.md, TROUBLESHOOTING.md, OPERATOR-PLAN.md, traefik/dynamic.yml

What deliberately stays:
- Internal module names ProvisioningService / ProvisioningModule (those
  describe an orchestration sub-concern, not the service's purpose)
- Tenant.provisioningStatus / provisioningErrors field names (state
  per integration, not service name)
- File services/platform-api/src/tenants/provisioning.service.ts
- 'Hetzner provisioning' references in production-prep docs (infrastructure
  provisioning, unrelated)

Verified end-to-end after rename: /api/me returns 200 with profile + 2
tenants + subscription, /api/tenants/dezky/reconcile returns 200 with
Authentik integration still ok.

OPERATOR-PLAN.md O.0 checkboxes ticked.

docs/OPERATOR-PLAN.md

@@ -5,7 +5,7 @@ for Dezky staff: managing tenants, partners, operating the platform.
 
 Distinct from the customer portal at `app.dezky.local`. Different OAuth client,
 different cookie domain, different surface — though they share Authentik as the
-IdP and (eventually) the provisioning service as the backend.
+IdP and (eventually) platform-api as the backend.
 
 This file is the running record of decisions made during the design grilling
 session. Updated inline as questions resolve.
@@ -42,7 +42,7 @@ renders against mock-data fixtures until its backend is built.
 
 Two genuinely new things on the backend:
 
-1. **Partner schema and CRUD** in `services/provisioning` — id, name, domain,
+1. **Partner schema and CRUD** in `services/platform-api` — id, name, domain,
    status, customers count (computed), MRR (computed), margin, sinceDate. Tenants
    gain an optional `partnerId` field. The existing `dezky` seed gets no partner.
 2. **Tenant lifecycle actions** beyond create — suspend, resume, change plan,
@@ -247,15 +247,18 @@ In rough priority order:
 Tick boxes as work lands. Each phase is roughly one commit. Phases must be
 done in order — earlier ones unblock later ones.
 
-### O.0 · Prep — service rename
+### O.0 · Prep — service rename ✓
 
-- [ ] Rename `services/provisioning/` → `services/platform-api/`
-- [ ] Update `package.json` name → `@dezky/platform-api`
-- [ ] Update `docker-compose.yml`: container name, service key, network
-      alias, volume names, env var `PROVISIONING_INTERNAL_URL` →
-      `PLATFORM_API_INTERNAL_URL`
-- [ ] Update portal proxy routes to point at `http://platform-api:3001`
-- [ ] Verify customer portal `/api/me` still works end-to-end after rename
+- [x] Rename `services/provisioning/` → `services/platform-api/`
+- [x] Update `package.json` name → `@dezky/platform-api`
+- [x] Update `docker-compose.yml`: container name, service key, volume name,
+      env var `PROVISIONING_INTERNAL_URL` → `PLATFORM_API_INTERNAL_URL`,
+      NUXT_API_BASE points at new hostname
+- [x] Update portal proxy routes to read `PLATFORM_API_INTERNAL_URL` and
+      default to `http://platform-api:3001`
+- [x] Sweep docs (README, CLAUDE.md, SERVICES.md, AUTHENTIK-SETUP.md,
+      NEXT-STEPS.md, TROUBLESHOOTING.md) for stale references
+- [x] Verify customer portal `/api/me` still works end-to-end after rename
 
 ### O.1 · Authentik — operator OAuth client