Use Ping's own credentials on the shared services

Infrastructure now gives each project its own Postgres role, S3 identity
limited to its bucket and a Zitadel service account that owns only its
project, instead of handing out the admin accounts.

- Postgres and S3 settings default to Ping's own (ping).
- zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's
  zitadel/.output/ping), waits for that PAT and uses it. It no longer
  creates the Zitadel project, which that account can't do:
  Infrastructure does.

backend/deploy/README.md

@@ -7,8 +7,8 @@ up first (see its own README for the exact command).
 ```bash
 cp deploy/.env.example deploy/.env
 # edit deploy/.env if your Infrastructure checkout isn't where
-# ZITADEL_ADMIN_PAT_DIR assumes, or if its S3_ACCESS_KEY/SECRET_KEY differ
-# from the defaults
+# ZITADEL_PAT_DIR assumes, or if its PING_* credentials differ from the
+# defaults
 
 docker compose -f deploy/compose.yml -f deploy/compose.dev.yml up -d
 ```