Infrastructure now gives each project its own Postgres role, S3 identity
limited to its bucket and a Zitadel service account that owns only its
project, instead of handing out the admin accounts.
- Postgres and S3 settings default to Ping's own (ping).
- zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's
zitadel/.output/ping), waits for that PAT and uses it. It no longer
creates the Zitadel project, which that account can't do:
Infrastructure does.
Admin