Use Ping's own credentials on the shared services

Infrastructure now gives each project its own Postgres role, S3 identity
limited to its bucket and a Zitadel service account that owns only its
project, instead of handing out the admin accounts.

- Postgres and S3 settings default to Ping's own (ping).
- zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's
  zitadel/.output/ping), waits for that PAT and uses it. It no longer
  creates the Zitadel project, which that account can't do:
  Infrastructure does.

backend/deploy/.env.example

@@ -4,9 +4,11 @@
 #   cp deploy/.env.example deploy/.env
 #
 # Requires ../../../Infrastructure running first (Postgres, Zitadel,
-# SeaweedFS). See ../../../Infrastructure/README.md. Everything marked
-# "must match Infrastructure's .env" below has to be the same value as the
-# one in that file.
+# SeaweedFS). See ../../../Infrastructure/README.md. Ping has its own
+# credentials on each shared service (role, S3 identity, Zitadel service
+# account), provisioned by Infrastructure. Every value marked
+# "= Infrastructure's PING_*" below has to be the same as that setting in
+# Infrastructure's .env.
 
 DOTNET_ENVIRONMENT=Development
 
@@ -16,17 +18,18 @@ PUBLIC_API_URL=http://localhost:5211
 PUBLIC_AUTH_URL=http://host.docker.internal:8080
 
 # --- PostgreSQL (Infrastructure's shared instance, Ping's own database) -----
-# POSTGRES_USER / POSTGRES_PASSWORD must match Infrastructure's .env.
+# Ping's own role, owner of ping_db only.
 POSTGRES_HOST=host.docker.internal
-POSTGRES_USER=postgres
-POSTGRES_PASSWORD=postgres
+POSTGRES_USER=ping
+# = Infrastructure's PING_DB_PASSWORD
+POSTGRES_PASSWORD=ping
 POSTGRES_DB=ping_db
 
 # --- Zitadel (OIDC, shared instance) -----------------------------------------
-# Path to the admin service-account PAT Infrastructure's Zitadel writes on
-# init. Adjust if your Infrastructure checkout lives somewhere else relative
-# to this one.
-ZITADEL_ADMIN_PAT_DIR=../../../Infrastructure/zitadel/.output
+# Folder with Ping's own Zitadel PAT (a service account that owns the Ping
+# project only), written by Infrastructure's `provision`. Adjust if your
+# Infrastructure checkout lives somewhere else relative to this one.
+ZITADEL_PAT_DIR=../../../Infrastructure/zitadel/.output/ping
 ZITADEL_DEV_MODE=true
 
 # OIDC clients: the zitadel-init one-shot service (see compose.yml) fills these in
@@ -35,9 +38,10 @@ AUTH_CLIENT_ID=
 WEB_CLIENT_ID=
 
 # --- SeaweedFS (S3, shared instance, Ping's own bucket) ----------------------
-# S3_ACCESS_KEY / S3_SECRET_KEY must match Infrastructure's .env.
-S3_ACCESS_KEY=admin_access_key
-S3_SECRET_KEY=admin_secret_key
+# Ping's own identity, limited to S3_BUCKET.
+# = Infrastructure's PING_S3_ACCESS_KEY / PING_S3_SECRET_KEY
+S3_ACCESS_KEY=ping_access_key
+S3_SECRET_KEY=ping_secret_key
 S3_BUCKET=ping-storage
 S3_PUBLIC_URL=http://host.docker.internal:8333
 S3_USE_HTTP=true