fix(infra): platform tenant is dezky-aps; disable prod seeding

The recreated company tenant got slug dezky-aps (wizard auto-derives from
the display name 'Dezky ApS'), so the dezky.eu apex guard 409'd it while
the config still said 'dezky'. Also SEED_ENABLED=false in prod — the
seeder resurrected a ghost 'dezky' tenant on every platform-api boot,
which is how the slug landscape kept shifting. config-rev 4 rolls the
pods.

infrastructure/production/fleet/apps/platform-api-config.yaml

@@ -23,7 +23,10 @@ data:
   # (PLATFORM_TENANT_SLUG) may claim the apex; nothing under it can be added
   # as a customer domain.
   PLATFORM_TENANT_DOMAIN: "dezky.eu"
-  PLATFORM_TENANT_SLUG: "dezky"
+  PLATFORM_TENANT_SLUG: "dezky-aps"
+  # No auto-seeded tenants in production — the dezky company tenant is
+  # created and owned through the operator like any other.
+  SEED_ENABLED: "false"
   # JWT validation for portal/operator-issued access tokens. Public Authentik
   # URLs on purpose: the token `iss` claim is the public URL, and the pod can
   # hairpin to it through the node's public IP.

infrastructure/production/fleet/apps/platform-api.yaml

@@ -21,7 +21,7 @@ spec:
       annotations:
         # Bump to force a rolling restart when only the ConfigMap changed —
         # pods read it as env, which is only resolved at container start.
-        dezky.eu/config-rev: "3"
+        dezky.eu/config-rev: "4"
     spec:
       containers:
         - name: platform-api