Give every project its own credentials on the shared services

Every project used the Postgres superuser, the RabbitMQ administrator, an
admin S3 identity and the Zitadel instance-admin PAT, so any one of them
could read or change the others' data.

A new one-shot, `provision` (runs on every `up`, idempotent), gives each
project in x-projects its own:

- Postgres role, owner of its database. No database is open to PUBLIC
  anymore, so a role can only connect to its own. An existing database
  and everything in it is handed over to the project's role.
- RabbitMQ user, with permissions on its own vhost only.
- Zitadel service account, PROJECT_OWNER of its own project only; its
  PAT is written to zitadel/.output/<project>/ for that project's
  zitadel-init to mount instead of the admin PAT.

SeaweedFS renders one S3 identity per project, limited to its bucket, and
refuses to start with a clear message on a malformed or repeated key.

The admin accounts stay with this stack. postgres-init is gone: provision
creates the databases. *.sh files are checked out with LF so they run in
the Linux containers from a Windows checkout.

.env.example

@@ -8,7 +8,7 @@
 # (then the browser can't reach 127.0.0.1-only ports through that name).
 DEV_BIND_ADDRESS=127.0.0.1
 
-# --- PostgreSQL (shared instance, one database per project) -----------------
+# --- PostgreSQL (shared instance; superuser for this stack only) -------------
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=postgres
 POSTGRES_HOST_PORT=5432
@@ -32,11 +32,11 @@ ZITADEL_DATABASE_PASSWORD=zitadel
 ZITADEL_ADMIN_USERNAME=admin
 ZITADEL_ADMIN_PASSWORD=Password1!
 
-# --- SeaweedFS (S3) ----------------------------------------------------------
+# --- SeaweedFS (S3; admin identity for this stack only) ---------------------
 S3_ACCESS_KEY=admin_access_key
 S3_SECRET_KEY=admin_secret_key
 
-# --- RabbitMQ -----------------------------------------------------------------
+# --- RabbitMQ (administrator for this stack only) ---------------------------
 RABBITMQ_DEFAULT_USER=guest
 RABBITMQ_DEFAULT_PASS=guest
 
@@ -44,3 +44,23 @@ RABBITMQ_DEFAULT_PASS=guest
 PGADMIN_DEFAULT_EMAIL=admin@infra.dev
 PGADMIN_DEFAULT_PASSWORD=admin
 PGADMIN_HOST_PORT=5050
+
+# --- Per-project credentials (see provision/) ---------------------------------
+# Each project gets its own Postgres role/database, RabbitMQ user/vhost and S3
+# identity limited to its bucket; the admin accounts above stay with this
+# stack. Each project's own .env copies its values from here. An empty value
+# means that project doesn't get that service.
+MUSIFY_DB_PASSWORD=musify
+MUSIFY_RABBITMQ_PASSWORD=musify
+MUSIFY_S3_ACCESS_KEY=musify_access_key
+MUSIFY_S3_SECRET_KEY=musify_secret_key
+
+PING_DB_PASSWORD=ping
+PING_RABBITMQ_PASSWORD=
+PING_S3_ACCESS_KEY=ping_access_key
+PING_S3_SECRET_KEY=ping_secret_key
+
+DOCKERMANAGER_DB_PASSWORD=dockermanager
+DOCKERMANAGER_RABBITMQ_PASSWORD=
+DOCKERMANAGER_S3_ACCESS_KEY=
+DOCKERMANAGER_S3_SECRET_KEY=