feat(server): add production-safe platform-template seed job

A fresh production environment only ran migrations, so the four built-in
platform templates were never inserted unless someone manually ran
dev-seed (which also writes broad demo data). Extract the platform
template upsert into a reusable repository.EnsurePlatformTemplates and
add a standalone cmd/seed-platform-templates that calls it. Bake the
binary into the migrate image and chain it after migrate up in both
docker-compose and the k3s migration job (mounting app config so the
binary can dial the right database).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/Dockerfile

@@ -23,15 +23,23 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     go build -trimpath -ldflags="-s -w" \
     -o /bin/service ./cmd/${SERVICE}
 
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=1 GOOS="${TARGETOS:-$(go env GOOS)}" GOARCH="${TARGETARCH:-$(go env GOARCH)}" \
+    go build -trimpath -ldflags="-s -w" \
+    -o /bin/seed-platform-templates ./cmd/seed-platform-templates
+
 # ─── Stage 2: Migration image (bundles SQL files + migrate binary) ─────────────
 FROM migrate/migrate:v4.19.1 AS migrate-tool
 
 FROM alpine:3.19 AS migrate
 RUN apk --no-cache add ca-certificates
 COPY --from=migrate-tool /usr/local/bin/migrate /usr/local/bin/migrate
+COPY --from=builder /bin/seed-platform-templates /usr/local/bin/seed-platform-templates
 COPY migrations/ /migrations/
 COPY migrations_monitoring/ /migrations_monitoring/
 COPY migrations_ops/ /migrations_ops/
+COPY configs/ /app/configs/
 ENTRYPOINT ["/usr/local/bin/migrate"]
 
 # ─── Stage 3: Runtime image ────────────────────────────────────────────────────