Give every project its own credentials on the shared services

Every project used the Postgres superuser, the RabbitMQ administrator, an
admin S3 identity and the Zitadel instance-admin PAT, so any one of them
could read or change the others' data.

A new one-shot, `provision` (runs on every `up`, idempotent), gives each
project in x-projects its own:

- Postgres role, owner of its database. No database is open to PUBLIC
  anymore, so a role can only connect to its own. An existing database
  and everything in it is handed over to the project's role.
- RabbitMQ user, with permissions on its own vhost only.
- Zitadel service account, PROJECT_OWNER of its own project only; its
  PAT is written to zitadel/.output/<project>/ for that project's
  zitadel-init to mount instead of the admin PAT.

SeaweedFS renders one S3 identity per project, limited to its bucket, and
refuses to start with a clear message on a malformed or repeated key.

The admin accounts stay with this stack. postgres-init is gone: provision
creates the databases. *.sh files are checked out with LF so they run in
the Linux containers from a Windows checkout.

.env.prod.example

@@ -10,7 +10,7 @@
 # the Zitadel masterkey needs exactly 32 characters) and auth.example.com
 # with the real hostname the shared edge (edge/) terminates TLS for.
 
-# --- PostgreSQL ---------------------------------------------------------------
+# --- PostgreSQL (superuser for this stack only) -----------------------------
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=CHANGE_ME
 
@@ -29,12 +29,32 @@ ZITADEL_ADMIN_USERNAME=admin@ikerdemo.cat
 ZITADEL_ADMIN_FIRST_NAME=Iker Demo
 ZITADEL_ADMIN_LAST_NAME=Admin
 ZITADEL_ADMIN_DISPLAY_NAME=Iker Demo Admin
+# Must pass Zitadel's password policy (upper, lower, number, symbol, 8+).
 ZITADEL_ADMIN_PASSWORD=CHANGE_ME
 
-# --- SeaweedFS (S3) ----------------------------------------------------------
+# --- SeaweedFS (S3; admin identity for this stack only) ---------------------
 S3_ACCESS_KEY=CHANGE_ME
 S3_SECRET_KEY=CHANGE_ME
 
-# --- RabbitMQ -----------------------------------------------------------------
+# --- RabbitMQ (administrator for this stack only) ---------------------------
 RABBITMQ_DEFAULT_USER=CHANGE_ME
 RABBITMQ_DEFAULT_PASS=CHANGE_ME
+
+# --- Per-project credentials (see provision/) ---------------------------------
+# Each project's own .env.prod copies its values from here. S3 keys: only
+# A-Z a-z 0-9 _ + / = . - (hex is fine). Empty = that project doesn't get
+# that service.
+MUSIFY_DB_PASSWORD=CHANGE_ME
+MUSIFY_RABBITMQ_PASSWORD=CHANGE_ME
+MUSIFY_S3_ACCESS_KEY=CHANGE_ME
+MUSIFY_S3_SECRET_KEY=CHANGE_ME
+
+PING_DB_PASSWORD=CHANGE_ME
+PING_RABBITMQ_PASSWORD=
+PING_S3_ACCESS_KEY=CHANGE_ME
+PING_S3_SECRET_KEY=CHANGE_ME
+
+DOCKERMANAGER_DB_PASSWORD=CHANGE_ME
+DOCKERMANAGER_RABBITMQ_PASSWORD=
+DOCKERMANAGER_S3_ACCESS_KEY=
+DOCKERMANAGER_S3_SECRET_KEY=