feat(server): add production-safe platform-template seed job

A fresh production environment only ran migrations, so the four built-in
platform templates were never inserted unless someone manually ran
dev-seed (which also writes broad demo data). Extract the platform
template upsert into a reusable repository.EnsurePlatformTemplates and
add a standalone cmd/seed-platform-templates that calls it. Bake the
binary into the migrate image and chain it after migrate up in both
docker-compose and the k3s migration job (mounting app config so the
binary can dial the right database).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

progress.md

@@ -691,3 +691,9 @@
 | What's the goal? | Resume the interrupted task by adding the missing `admin-web` frontend foundation on top of the finished backend |
 | What have I learned? | The tenant backend is stable enough to support a real login + dashboard frontend slice, and a real browser pass was valuable because it caught a submit wiring bug that static checks missed |
 | What have I done? | Added the pnpm frontend workspace, built `apps/admin-web`, wired auth and dashboard data to `tenant-api`, reduced the bundle size, and passed install/build/preview plus browser login verification |
+## 2026-05-01T06:43:58Z - Platform template seed deployment
+
+- Investigated the "普通通用模版" cards shown in the screenshot.
+- Confirmed the four platform templates are stored in `article_templates` and currently seeded by `server/cmd/dev-seed/main.go`.
+- Confirmed production deployment jobs only run database migrations, so a fresh environment can miss the four template records unless dev seed is run manually.
+- Decision: add a production-safe platform-template initializer and wire it into the migrate job/image instead of running the broad dev seed path.