chore(services): rename services/provisioning -> services/platform-api

O.0 prep from OPERATOR-PLAN.md. Mechanical refactor before adding partner
management and operator-specific endpoints. The service now owns more than
just provisioning orchestration (it'll soon own partners, tenant lifecycle
actions, multi-audience JWT validation), so the name 'platform-api' reflects
its scope better.

What changed:
- Directory: services/provisioning/ -> services/platform-api/
- Package: @dezky/provisioning -> @dezky/platform-api
- Docker: container_name dezky-provisioning -> dezky-platform-api;
  compose service key 'provisioning' -> 'platform-api'; volume
  provisioning_node_modules -> platform_api_node_modules
- Portal: PROVISIONING_INTERNAL_URL env var -> PLATFORM_API_INTERNAL_URL,
  default URL http://provisioning:3001 -> http://platform-api:3001 in all
  three proxy routes (me.get.ts, tenants/index.post.ts, tenants/[slug]/
  reconcile.post.ts), plus NUXT_API_BASE updated
- Health endpoint service identifier and main.ts log lines updated to
  'dezky-platform-api'
- Docs swept: README, CLAUDE.md, SERVICES.md, AUTHENTIK-SETUP.md,
  NEXT-STEPS.md, TROUBLESHOOTING.md, OPERATOR-PLAN.md, traefik/dynamic.yml

What deliberately stays:
- Internal module names ProvisioningService / ProvisioningModule (those
  describe an orchestration sub-concern, not the service's purpose)
- Tenant.provisioningStatus / provisioningErrors field names (state
  per integration, not service name)
- File services/platform-api/src/tenants/provisioning.service.ts
- 'Hetzner provisioning' references in production-prep docs (infrastructure
  provisioning, unrelated)

Verified end-to-end after rename: /api/me returns 200 with profile + 2
tenants + subscription, /api/tenants/dezky/reconcile returns 200 with
Authentik integration still ok.

OPERATOR-PLAN.md O.0 checkboxes ticked.

services/platform-api/src/schemas/tenant.schema.ts

@@ -0,0 +1,84 @@
+import { Prop, Schema, SchemaFactory } from '@nestjs/mongoose'
+import { HydratedDocument } from 'mongoose'
+
+export type TenantDocument = HydratedDocument<Tenant>
+
+export type TenantStatus = 'pending' | 'active' | 'suspended' | 'deleted'
+export type TenantPlan = 'mvp' | 'pro' | 'enterprise'
+
+// One field per external integration. 'pending' = not yet tried; 'ok' = synced;
+// 'error' = last attempt failed (see provisioningErrors for detail).
+export type IntegrationState = 'pending' | 'ok' | 'error' | 'skipped'
+
+@Schema({ collection: 'tenants', timestamps: true })
+export class Tenant {
+  // URL-safe identifier, also used as Authentik group name. Lowercase, hyphenated.
+  @Prop({ required: true, unique: true, index: true, lowercase: true, trim: true })
+  slug!: string
+
+  @Prop({ required: true, trim: true })
+  name!: string
+
+  @Prop({ enum: ['pending', 'active', 'suspended', 'deleted'], default: 'pending', index: true })
+  status!: TenantStatus
+
+  @Prop({ enum: ['mvp', 'pro', 'enterprise'], default: 'mvp' })
+  plan!: TenantPlan
+
+  // Custom domains attached to this tenant. First entry is the primary host.
+  @Prop({ type: [String], default: [] })
+  domains!: string[]
+
+  // External system handles — filled in by the provisioning worker (Phase 4)
+  @Prop({ index: true, sparse: true })
+  authentikGroupId?: string
+
+  @Prop({ sparse: true })
+  ocisSpaceId?: string
+
+  @Prop({ sparse: true })
+  stalwartDomain?: string
+
+  // Free-form billing context. Stripe IDs live on Subscription, not here.
+  @Prop({
+    type: {
+      companyName: String,
+      vatId: String,
+      country: String,
+      contactEmail: String,
+    },
+    default: {},
+  })
+  billingInfo!: {
+    companyName?: string
+    vatId?: string
+    country?: string
+    contactEmail?: string
+  }
+
+  // Per-integration provisioning state. Each one is updated independently when its
+  // upstream API call succeeds or fails — orchestration is best-effort, not atomic.
+  @Prop({
+    type: {
+      authentik: { type: String, enum: ['pending', 'ok', 'error', 'skipped'], default: 'pending' },
+      stalwart: { type: String, enum: ['pending', 'ok', 'error', 'skipped'], default: 'pending' },
+      ocis: { type: String, enum: ['pending', 'ok', 'error', 'skipped'], default: 'pending' },
+    },
+    default: () => ({ authentik: 'pending', stalwart: 'pending', ocis: 'pending' }),
+  })
+  provisioningStatus!: {
+    authentik: IntegrationState
+    stalwart: IntegrationState
+    ocis: IntegrationState
+  }
+
+  // Last error message per integration. Cleared when a subsequent attempt succeeds.
+  @Prop({ type: Object, default: {} })
+  provisioningErrors!: {
+    authentik?: string
+    stalwart?: string
+    ocis?: string
+  }
+}
+
+export const TenantSchema = SchemaFactory.createForClass(Tenant)