chore(services): rename services/provisioning -> services/platform-api

O.0 prep from OPERATOR-PLAN.md. Mechanical refactor before adding partner
management and operator-specific endpoints. The service now owns more than
just provisioning orchestration (it'll soon own partners, tenant lifecycle
actions, multi-audience JWT validation), so the name 'platform-api' reflects
its scope better.

What changed:
- Directory: services/provisioning/ -> services/platform-api/
- Package: @dezky/provisioning -> @dezky/platform-api
- Docker: container_name dezky-provisioning -> dezky-platform-api;
  compose service key 'provisioning' -> 'platform-api'; volume
  provisioning_node_modules -> platform_api_node_modules
- Portal: PROVISIONING_INTERNAL_URL env var -> PLATFORM_API_INTERNAL_URL,
  default URL http://provisioning:3001 -> http://platform-api:3001 in all
  three proxy routes (me.get.ts, tenants/index.post.ts, tenants/[slug]/
  reconcile.post.ts), plus NUXT_API_BASE updated
- Health endpoint service identifier and main.ts log lines updated to
  'dezky-platform-api'
- Docs swept: README, CLAUDE.md, SERVICES.md, AUTHENTIK-SETUP.md,
  NEXT-STEPS.md, TROUBLESHOOTING.md, OPERATOR-PLAN.md, traefik/dynamic.yml

What deliberately stays:
- Internal module names ProvisioningService / ProvisioningModule (those
  describe an orchestration sub-concern, not the service's purpose)
- Tenant.provisioningStatus / provisioningErrors field names (state
  per integration, not service name)
- File services/platform-api/src/tenants/provisioning.service.ts
- 'Hetzner provisioning' references in production-prep docs (infrastructure
  provisioning, unrelated)

Verified end-to-end after rename: /api/me returns 200 with profile + 2
tenants + subscription, /api/tenants/dezky/reconcile returns 200 with
Authentik integration still ok.

OPERATOR-PLAN.md O.0 checkboxes ticked.

services/platform-api/package.json

@@ -1,8 +1,8 @@
 {
-  "name": "@dezky/provisioning",
+  "name": "@dezky/platform-api",
   "version": "0.0.1",
   "private": true,
-  "description": "Dezky tenant provisioning worker — NestJS",
+  "description": "Dezky platform API — tenants, partners, users, provisioning orchestration (NestJS)",
   "scripts": {
     "build": "nest build",
     "start": "nest start",

services/platform-api/src/health.controller.ts

@@ -6,7 +6,7 @@ export class HealthController {
   check() {
     return {
       status: 'ok',
-      service: 'dezky-provisioning',
+      service: 'dezky-platform-api',
       timestamp: new Date().toISOString(),
     }
   }

services/platform-api/src/main.ts

@@ -1,5 +1,6 @@
-// Dezky Provisioning Service — Entry point
-// Handles tenant lifecycle: create, suspend, delete, billing webhooks.
+// Dezky platform API — Entry point.
+// Owns the platform control plane: tenants, partners, users, subscriptions,
+// plus the provisioning orchestration (Authentik / Stalwart / OCIS).
 
 import { ValidationPipe } from '@nestjs/common'
 import { NestFactory } from '@nestjs/core'
@@ -29,10 +30,10 @@ async function bootstrap() {
   const port = Number(process.env.PORT ?? 3001)
   await app.listen(port, '0.0.0.0')
 
-  console.log(`Provisioning service listening on http://0.0.0.0:${port}`)
+  console.log(`platform-api listening on http://0.0.0.0:${port}`)
 }
 
 bootstrap().catch((err) => {
-  console.error('Failed to start provisioning service', err)
+  console.error('Failed to start platform-api', err)
   process.exit(1)
 })