Use Musify's own credentials on the shared services

Infrastructure now gives each project its own Postgres role, RabbitMQ
user and vhost, S3 identity limited to its bucket and a Zitadel service
account that owns only its project, instead of handing out the admin
accounts.

- Postgres, RabbitMQ and S3 settings default to Musify's own (musify).
- MassTransit connects to the `musify` vhost (RABBITMQ_VHOST, taken from
  the address path); RABBITMQ_DEFAULT_USER/PASS become RABBITMQ_USER and
  RABBITMQ_PASSWORD.
- zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's
  zitadel/.output/musify) and uses that PAT. It no longer creates the
  Zitadel project, which that account can't do: Infrastructure does.

deploy/.env.example

@@ -5,8 +5,10 @@
 #
 # Requires ../../../Infrastructure running first (Postgres, Zitadel,
 # SeaweedFS, RabbitMQ, Jaeger). See ../../../Infrastructure/README.md.
-# Everything marked "must match Infrastructure's .env" below has to be the
-# same value as the one in that file.
+# Musify has its own credentials on every shared service (role, vhost, S3
+# identity, Zitadel service account), provisioned by Infrastructure. Every
+# value marked "= Infrastructure's MUSIFY_*" below has to be the same as that
+# setting in Infrastructure's .env.
 
 DOTNET_ENVIRONMENT=Development
 
@@ -21,17 +23,18 @@ PUBLIC_STREAM_URL=http://localhost:8081
 PUBLIC_AUTH_URL=http://host.docker.internal:8080
 
 # --- PostgreSQL (Infrastructure's shared instance, Musify's own database) ---
-# POSTGRES_USER / POSTGRES_PASSWORD must match Infrastructure's .env.
+# Musify's own role, owner of musify_db only.
 POSTGRES_HOST=host.docker.internal
-POSTGRES_USER=postgres
-POSTGRES_PASSWORD=postgres
+POSTGRES_USER=musify
+# = Infrastructure's MUSIFY_DB_PASSWORD
+POSTGRES_PASSWORD=musify
 POSTGRES_DB=musify_db
 
 # --- Zitadel (OIDC, shared instance) -----------------------------------------
-# Path to the admin service-account PAT Infrastructure's Zitadel writes on
-# init. Adjust if your Infrastructure checkout lives somewhere else relative
-# to this one.
-ZITADEL_ADMIN_PAT_DIR=../../../Infrastructure/zitadel/.output
+# Folder with Musify's own Zitadel PAT (a service account that owns the
+# Musify project only), written by Infrastructure's `provision`. Adjust if
+# your Infrastructure checkout lives somewhere else relative to this one.
+ZITADEL_PAT_DIR=../../../Infrastructure/zitadel/.output/musify
 # Allows the OIDC apps this project creates to use plain-http redirect URIs
 # (dev only).
 ZITADEL_DEV_MODE=true
@@ -43,16 +46,19 @@ WEB_CLIENT_ID=
 WEB_CLIENT_SECRET=
 
 # --- RabbitMQ (shared instance, MassTransit) --------------------------------
-# Must match Infrastructure's .env.
+# Musify's own user, only on its own vhost.
 RABBITMQ_HOST=host.docker.internal
-RABBITMQ_DEFAULT_USER=guest
-RABBITMQ_DEFAULT_PASS=guest
+RABBITMQ_VHOST=musify
+RABBITMQ_USER=musify
+# = Infrastructure's MUSIFY_RABBITMQ_PASSWORD
+RABBITMQ_PASSWORD=musify
 
 # --- SeaweedFS (S3, shared instance, Musify's own bucket) --------------------
-# S3_ACCESS_KEY / S3_SECRET_KEY must match Infrastructure's .env.
+# Musify's own identity, limited to S3_BUCKET.
 SEAWEEDFS_HOST=host.docker.internal
-S3_ACCESS_KEY=admin_access_key
-S3_SECRET_KEY=admin_secret_key
+# = Infrastructure's MUSIFY_S3_ACCESS_KEY / MUSIFY_S3_SECRET_KEY
+S3_ACCESS_KEY=musify_access_key
+S3_SECRET_KEY=musify_secret_key
 S3_BUCKET=webapi-storage
 S3_PUBLIC_URL=http://host.docker.internal:8333
 S3_INTERNAL_URL=http://host.docker.internal:8333