chore(services): rename services/provisioning -> services/platform-api

O.0 prep from OPERATOR-PLAN.md. Mechanical refactor before adding partner
management and operator-specific endpoints. The service now owns more than
just provisioning orchestration (it'll soon own partners, tenant lifecycle
actions, multi-audience JWT validation), so the name 'platform-api' reflects
its scope better.

What changed:
- Directory: services/provisioning/ -> services/platform-api/
- Package: @dezky/provisioning -> @dezky/platform-api
- Docker: container_name dezky-provisioning -> dezky-platform-api;
  compose service key 'provisioning' -> 'platform-api'; volume
  provisioning_node_modules -> platform_api_node_modules
- Portal: PROVISIONING_INTERNAL_URL env var -> PLATFORM_API_INTERNAL_URL,
  default URL http://provisioning:3001 -> http://platform-api:3001 in all
  three proxy routes (me.get.ts, tenants/index.post.ts, tenants/[slug]/
  reconcile.post.ts), plus NUXT_API_BASE updated
- Health endpoint service identifier and main.ts log lines updated to
  'dezky-platform-api'
- Docs swept: README, CLAUDE.md, SERVICES.md, AUTHENTIK-SETUP.md,
  NEXT-STEPS.md, TROUBLESHOOTING.md, OPERATOR-PLAN.md, traefik/dynamic.yml

What deliberately stays:
- Internal module names ProvisioningService / ProvisioningModule (those
  describe an orchestration sub-concern, not the service's purpose)
- Tenant.provisioningStatus / provisioningErrors field names (state
  per integration, not service name)
- File services/platform-api/src/tenants/provisioning.service.ts
- 'Hetzner provisioning' references in production-prep docs (infrastructure
  provisioning, unrelated)

Verified end-to-end after rename: /api/me returns 200 with profile + 2
tenants + subscription, /api/tenants/dezky/reconcile returns 200 with
Authentik integration still ok.

OPERATOR-PLAN.md O.0 checkboxes ticked.

docs/SERVICES.md

@@ -219,7 +219,7 @@ curl -k https://office.dezky.local/hosting/discovery
 
 **Environment:**
 - `NUXT_PUBLIC_AUTH_URL`: Authentik URL (client-side)
-- `NUXT_API_BASE`: provisioning service URL (server-side)
+- `NUXT_API_BASE`: platform-api URL (server-side)
 - `MONGODB_URI`: MongoDB connection string
 
 **Debug:**
@@ -233,12 +233,12 @@ docker compose exec portal sh
 
 ---
 
-## Provisioning Service (NestJS)
+## Platform API (NestJS)
 
-**Container:** `dezky-provisioning`
-**Port:** 3001 (internal only)
-**Source:** `services/provisioning/`
-**Purpose:** Tenant lifecycle, billing webhooks, service orchestration
+**Container:** `dezky-platform-api`
+**Port:** 3001 (also exposed via Traefik at `api.dezky.local`)
+**Source:** `services/platform-api/`
+**Purpose:** Platform control plane — tenants, partners, users, subscriptions, provisioning orchestration, billing webhooks
 
 **Endpoints to implement:**
 - `POST /tenants` — Create tenant
@@ -255,8 +255,8 @@ docker compose exec portal sh
 
 **Debug:**
 ```bash
-docker compose logs -f provisioning
+docker compose logs -f platform-api
 
 # Test health endpoint
-docker compose exec provisioning wget -qO- http://localhost:3001/health
+docker compose exec platform-api wget -qO- http://localhost:3001/health
 ```