Use Musify's own credentials on the shared services

Infrastructure now gives each project its own Postgres role, RabbitMQ
user and vhost, S3 identity limited to its bucket and a Zitadel service
account that owns only its project, instead of handing out the admin
accounts.

- Postgres, RabbitMQ and S3 settings default to Musify's own (musify).
- MassTransit connects to the `musify` vhost (RABBITMQ_VHOST, taken from
  the address path); RABBITMQ_DEFAULT_USER/PASS become RABBITMQ_USER and
  RABBITMQ_PASSWORD.
- zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's
  zitadel/.output/musify) and uses that PAT. It no longer creates the
  Zitadel project, which that account can't do: Infrastructure does.

deploy/.env.prod.example

@@ -28,14 +28,16 @@ PUBLIC_AUTH_URL=https://auth.example.com
 S3_PUBLIC_URL=https://s3.example.com
 
 # --- PostgreSQL (Infrastructure's shared instance, Musify's own database) ---
-# POSTGRES_USER / POSTGRES_PASSWORD must match Infrastructure's .env.prod.
+# Musify's own role, owner of musify_db only.
 POSTGRES_HOST=postgres
-POSTGRES_USER=postgres
+POSTGRES_USER=musify
+# = Infrastructure's MUSIFY_DB_PASSWORD
 POSTGRES_PASSWORD=CHANGE_ME
 POSTGRES_DB=musify_db
 
 # --- Zitadel (OIDC, shared instance) -----------------------------------------
-ZITADEL_ADMIN_PAT_DIR=../../../Infrastructure/zitadel/.output
+# Folder with Musify's own Zitadel PAT, written by Infrastructure's `provision`.
+ZITADEL_PAT_DIR=../../../Infrastructure/zitadel/.output/musify
 ZITADEL_DEV_MODE=false
 
 # OIDC clients: the zitadel-init one-shot service (see compose.yml) fills
@@ -46,11 +48,14 @@ WEB_CLIENT_SECRET=
 
 # --- RabbitMQ (shared instance, MassTransit) --------------------------------
 RABBITMQ_HOST=rabbitmq
-RABBITMQ_DEFAULT_USER=musify
-RABBITMQ_DEFAULT_PASS=CHANGE_ME
+RABBITMQ_VHOST=musify
+RABBITMQ_USER=musify
+# = Infrastructure's MUSIFY_RABBITMQ_PASSWORD
+RABBITMQ_PASSWORD=CHANGE_ME
 
 # --- SeaweedFS (S3, shared instance, Musify's own bucket) --------------------
 SEAWEEDFS_HOST=seaweedfs
+# = Infrastructure's MUSIFY_S3_ACCESS_KEY / MUSIFY_S3_SECRET_KEY
 S3_ACCESS_KEY=CHANGE_ME
 S3_SECRET_KEY=CHANGE_ME
 S3_BUCKET=webapi-storage