Use Ping's own credentials on the shared services

Infrastructure now gives each project its own Postgres role, S3 identity
limited to its bucket and a Zitadel service account that owns only its
project, instead of handing out the admin accounts.

- Postgres and S3 settings default to Ping's own (ping).
- zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's
  zitadel/.output/ping), waits for that PAT and uses it. It no longer
  creates the Zitadel project, which that account can't do:
  Infrastructure does.

README.md

@@ -54,7 +54,7 @@ in place:
 ```bash
 cp backend/deploy/.env.example backend/deploy/.env
 # edit backend/deploy/.env if your Infrastructure checkout isn't where
-# ZITADEL_ADMIN_PAT_DIR assumes, or its S3 keys differ from the defaults
+# ZITADEL_PAT_DIR assumes, or its PING_* credentials differ from the defaults
 
 docker compose -f backend/deploy/compose.yml -f backend/deploy/compose.dev.yml up -d
 ```