fix(domains): platform tenant slug is configurable (prod: dezky-aps)

The company tenant ended up as slug dezky-aps (the seeded 'dezky' tenant was
deleted), so the hardcoded apex allowance for slug 'dezky' would have
rejected adding dezky.eu to the real tenant. PLATFORM_TENANT_SLUG env
(default 'dezky') now names the only tenant allowed to claim the
PLATFORM_TENANT_DOMAIN apex.

infrastructure/production/fleet/apps/platform-api-config.yaml

@@ -19,9 +19,11 @@ data:
   STALWART_ADMIN_USER: "admin@dezky.eu"
   STALWART_PROVISIONING_ENABLED: "true"
   # Base for per-tenant service mail domains ({slug}.dezky.eu) AND the
-  # reserved namespace for customer domains: only the dezky tenant may claim
-  # the apex; nothing under it can be added as a customer domain.
+  # reserved namespace for customer domains: only the company's own tenant
+  # (PLATFORM_TENANT_SLUG) may claim the apex; nothing under it can be added
+  # as a customer domain.
   PLATFORM_TENANT_DOMAIN: "dezky.eu"
+  PLATFORM_TENANT_SLUG: "dezky-aps"
   # JWT validation for portal/operator-issued access tokens. Public Authentik
   # URLs on purpose: the token `iss` claim is the public URL, and the pod can
   # hairpin to it through the node's public IP.