feat(deploy): consolidated dev stack with auto-provisioned Zitadel

Single docker-compose stack for local development (Postgres, Zitadel,
RabbitMQ, SeaweedFS + bucket init, Jaeger) plus an optional overlay to run
the .NET apps in Docker. up.ps1 orchestrates the full bootstrap: stack up,
stream-ticket keys, EF Core migrations and Zitadel provisioning.

- Zitadel is provisioned automatically (service-account PAT -> project +
  OIDC app with JWT access token); the generated ClientId is wired into
  Musify.Api user-secrets and .env. No manual console steps.
- ZITADEL_EXTERNAL_DOMAIN=host.docker.internal so token validation works
  both with local apps and full-docker.
- App Dockerfiles copy AppSettings*.json to lowercase so config loads on
  case-sensitive Linux; Worker image ships ffmpeg.
- Scripts split by responsibility (common/stream-keys/migrate/provision);
  apps overlay de-duped via YAML anchors.
- Remove the superseded standalone seaweedfs compose; point docs/development
  at the unified stack.

deploy/scripts/common.ps1

@@ -0,0 +1,15 @@
+#requires -Version 5.1
+# Shared helpers for the deploy scripts.
+
+function Write-Step([string]$Message) { Write-Host "`n==> $Message" -ForegroundColor Cyan }
+
+# Parses a .env file into a hashtable (ignores comments and blank lines).
+function Read-DotEnv([string]$Path) {
+    $values = @{}
+    if (Test-Path $Path) {
+        Get-Content $Path | ForEach-Object {
+            if ($_ -match '^\s*([^#=\s][^=]*)=(.*)$') { $values[$matches[1].Trim()] = $matches[2].Trim() }
+        }
+    }
+    return $values
+}

deploy/scripts/migrate.ps1

@@ -0,0 +1,15 @@
+#requires -Version 5.1
+# Applies EF Core migrations to the Musify database.
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$ConnectionString)
+
+$ErrorActionPreference = "Stop"
+$infraProject = Resolve-Path (Join-Path $PSScriptRoot "..\..\backend\Musify.Infrastructure")
+
+# The design-time factory reads the connection string from user-secrets.
+dotnet user-secrets set "Database:ConnectionString" $ConnectionString --project $infraProject | Out-Null
+
+# Infrastructure is also the startup project: it owns the IDesignTimeDbContextFactory
+# and the EFCore.Design package (Musify.Api does not reference Design).
+dotnet ef database update --project $infraProject --startup-project $infraProject --context Database
+if ($LASTEXITCODE -ne 0) { throw "EF Core migration failed" }

deploy/scripts/stream-keys.ps1

@@ -0,0 +1,28 @@
+#requires -Version 5.1
+# Generates the RS256 key pair used to sign (API) and verify (Gateway) stream tickets.
+# No-op if both keys already exist.
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$KeysDir)
+
+$ErrorActionPreference = "Stop"
+$privateKey = Join-Path $KeysDir "stream_private.pem"
+$publicKey  = Join-Path $KeysDir "stream_public.pem"
+
+if ((Test-Path $privateKey) -and (Test-Path $publicKey)) {
+    Write-Host "Stream-ticket keys already present in $KeysDir"
+    return
+}
+
+if (-not (Test-Path $KeysDir)) { New-Item -ItemType Directory -Path $KeysDir | Out-Null }
+
+if (Get-Command openssl -ErrorAction SilentlyContinue) {
+    & openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out $privateKey
+    & openssl rsa -in $privateKey -pubout -out $publicKey
+} else {
+    $rsa = [System.Security.Cryptography.RSA]::Create(2048)
+    [System.IO.File]::WriteAllText($privateKey, $rsa.ExportPkcs8PrivateKeyPem())
+    [System.IO.File]::WriteAllText($publicKey,  $rsa.ExportSubjectPublicKeyInfoPem())
+    $rsa.Dispose()
+}
+
+Write-Host "Generated stream-ticket keys in $KeysDir"