chore(services): rename services/provisioning -> services/platform-api

O.0 prep from OPERATOR-PLAN.md. Mechanical refactor before adding partner
management and operator-specific endpoints. The service now owns more than
just provisioning orchestration (it'll soon own partners, tenant lifecycle
actions, multi-audience JWT validation), so the name 'platform-api' reflects
its scope better.

What changed:
- Directory: services/provisioning/ -> services/platform-api/
- Package: @dezky/provisioning -> @dezky/platform-api
- Docker: container_name dezky-provisioning -> dezky-platform-api;
  compose service key 'provisioning' -> 'platform-api'; volume
  provisioning_node_modules -> platform_api_node_modules
- Portal: PROVISIONING_INTERNAL_URL env var -> PLATFORM_API_INTERNAL_URL,
  default URL http://provisioning:3001 -> http://platform-api:3001 in all
  three proxy routes (me.get.ts, tenants/index.post.ts, tenants/[slug]/
  reconcile.post.ts), plus NUXT_API_BASE updated
- Health endpoint service identifier and main.ts log lines updated to
  'dezky-platform-api'
- Docs swept: README, CLAUDE.md, SERVICES.md, AUTHENTIK-SETUP.md,
  NEXT-STEPS.md, TROUBLESHOOTING.md, OPERATOR-PLAN.md, traefik/dynamic.yml

What deliberately stays:
- Internal module names ProvisioningService / ProvisioningModule (those
  describe an orchestration sub-concern, not the service's purpose)
- Tenant.provisioningStatus / provisioningErrors field names (state
  per integration, not service name)
- File services/platform-api/src/tenants/provisioning.service.ts
- 'Hetzner provisioning' references in production-prep docs (infrastructure
  provisioning, unrelated)

Verified end-to-end after rename: /api/me returns 200 with profile + 2
tenants + subscription, /api/tenants/dezky/reconcile returns 200 with
Authentik integration still ok.

OPERATOR-PLAN.md O.0 checkboxes ticked.

services/platform-api/src/tenants/tenants.service.ts

@@ -0,0 +1,68 @@
+import { ConflictException, Injectable, NotFoundException } from '@nestjs/common'
+import { InjectModel } from '@nestjs/mongoose'
+import { Model, Types } from 'mongoose'
+import { Tenant, TenantDocument } from '../schemas/tenant.schema.js'
+import type { CreateTenantDto } from './dto/create-tenant.dto.js'
+import type { UpdateTenantDto } from './dto/update-tenant.dto.js'
+import { ProvisioningService } from './provisioning.service.js'
+
+@Injectable()
+export class TenantsService {
+  constructor(
+    @InjectModel(Tenant.name) private readonly tenantModel: Model<TenantDocument>,
+    private readonly provisioning: ProvisioningService,
+  ) {}
+
+  async create(dto: CreateTenantDto): Promise<TenantDocument> {
+    const exists = await this.tenantModel.exists({ slug: dto.slug })
+    if (exists) throw new ConflictException(`Tenant with slug "${dto.slug}" already exists`)
+    const tenant = await this.tenantModel.create({ ...dto, status: 'pending' })
+    // Provision external resources best-effort. Errors are recorded on the doc;
+    // the caller can re-POST or call /tenants/:slug/reconcile to retry.
+    return this.provisioning.reconcile(tenant)
+  }
+
+  async reconcile(slug: string): Promise<TenantDocument> {
+    const tenant = await this.findOneBySlug(slug)
+    return this.provisioning.reconcile(tenant)
+  }
+
+  async findAll(): Promise<TenantDocument[]> {
+    return this.tenantModel.find().sort({ createdAt: -1 }).exec()
+  }
+
+  async findByIds(ids: Types.ObjectId[]): Promise<TenantDocument[]> {
+    if (ids.length === 0) return []
+    return this.tenantModel
+      .find({ _id: { $in: ids } })
+      .sort({ createdAt: -1 })
+      .exec()
+  }
+
+  async findOneBySlug(slug: string): Promise<TenantDocument> {
+    const tenant = await this.tenantModel.findOne({ slug }).exec()
+    if (!tenant) throw new NotFoundException(`Tenant "${slug}" not found`)
+    return tenant
+  }
+
+  async findOneById(id: string | Types.ObjectId): Promise<TenantDocument> {
+    const tenant = await this.tenantModel.findById(id).exec()
+    if (!tenant) throw new NotFoundException(`Tenant ${id} not found`)
+    return tenant
+  }
+
+  async update(slug: string, dto: UpdateTenantDto): Promise<TenantDocument> {
+    const tenant = await this.tenantModel
+      .findOneAndUpdate({ slug }, dto, { new: true, runValidators: true })
+      .exec()
+    if (!tenant) throw new NotFoundException(`Tenant "${slug}" not found`)
+    return tenant
+  }
+
+  async softDelete(slug: string): Promise<void> {
+    const result = await this.tenantModel
+      .updateOne({ slug }, { status: 'deleted' })
+      .exec()
+    if (result.matchedCount === 0) throw new NotFoundException(`Tenant "${slug}" not found`)
+  }
+}