feat(deploy): consolidated dev stack with auto-provisioned Zitadel

Single docker-compose stack for local development (Postgres, Zitadel,
RabbitMQ, SeaweedFS + bucket init, Jaeger) plus an optional overlay to run
the .NET apps in Docker. up.ps1 orchestrates the full bootstrap: stack up,
stream-ticket keys, EF Core migrations and Zitadel provisioning.

- Zitadel is provisioned automatically (service-account PAT -> project +
  OIDC app with JWT access token); the generated ClientId is wired into
  Musify.Api user-secrets and .env. No manual console steps.
- ZITADEL_EXTERNAL_DOMAIN=host.docker.internal so token validation works
  both with local apps and full-docker.
- App Dockerfiles copy AppSettings*.json to lowercase so config loads on
  case-sensitive Linux; Worker image ships ffmpeg.
- Scripts split by responsibility (common/stream-keys/migrate/provision);
  apps overlay de-duped via YAML anchors.
- Remove the superseded standalone seaweedfs compose; point docs/development
  at the unified stack.

deploy/scripts/stream-keys.ps1

@@ -0,0 +1,28 @@
+#requires -Version 5.1
+# Generates the RS256 key pair used to sign (API) and verify (Gateway) stream tickets.
+# No-op if both keys already exist.
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$KeysDir)
+
+$ErrorActionPreference = "Stop"
+$privateKey = Join-Path $KeysDir "stream_private.pem"
+$publicKey  = Join-Path $KeysDir "stream_public.pem"
+
+if ((Test-Path $privateKey) -and (Test-Path $publicKey)) {
+    Write-Host "Stream-ticket keys already present in $KeysDir"
+    return
+}
+
+if (-not (Test-Path $KeysDir)) { New-Item -ItemType Directory -Path $KeysDir | Out-Null }
+
+if (Get-Command openssl -ErrorAction SilentlyContinue) {
+    & openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out $privateKey
+    & openssl rsa -in $privateKey -pubout -out $publicKey
+} else {
+    $rsa = [System.Security.Cryptography.RSA]::Create(2048)
+    [System.IO.File]::WriteAllText($privateKey, $rsa.ExportPkcs8PrivateKeyPem())
+    [System.IO.File]::WriteAllText($publicKey,  $rsa.ExportSubjectPublicKeyInfoPem())
+    $rsa.Dispose()
+}
+
+Write-Host "Generated stream-ticket keys in $KeysDir"