feat(server): add production-safe platform-template seed job

A fresh production environment only ran migrations, so the four built-in
platform templates were never inserted unless someone manually ran
dev-seed (which also writes broad demo data). Extract the platform
template upsert into a reusable repository.EnsurePlatformTemplates and
add a standalone cmd/seed-platform-templates that calls it. Bake the
binary into the migrate image and chain it after migrate up in both
docker-compose and the k3s migration job (mounting app config so the
binary can dial the right database).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/cmd/dev-seed/main.go

@@ -485,33 +485,8 @@ func ensureQuotaLedger(ctx context.Context, tx pgx.Tx, tenantID int64, total int
 }
 
 func ensureTemplates(ctx context.Context, tx pgx.Tx) error {
-	for _, tpl := range prompts.PlatformTemplateSeeds() {
-		_, err := tx.Exec(ctx, `
-			INSERT INTO article_templates (scope, origin_type, template_key, template_name, prompt_template, prompt_visibility, card_config_json, status)
-			VALUES ('platform', 'platform', $1, $2, $3, 'visible', $4::jsonb, 'active')
-			ON CONFLICT DO NOTHING
-		`, tpl.Key, tpl.Name, tpl.PromptTemplate, tpl.CardConfigJSON)
-		if err != nil {
-			return wrapSeedErr("insert template", err)
-		}
-
-		_, err = tx.Exec(ctx, `
-			UPDATE article_templates
-			SET template_name = $2,
-				prompt_template = $3,
-				card_config_json = $4::jsonb,
-				prompt_visibility = 'visible',
-				status = 'active',
-				updated_at = NOW()
-			WHERE scope = 'platform'
-			  AND template_key = $1
-			  AND deleted_at IS NULL
-		`, tpl.Key, tpl.Name, tpl.PromptTemplate, tpl.CardConfigJSON)
-		if err != nil {
-			return wrapSeedErr("update template", err)
-		}
-	}
-	return nil
+	_, err := repository.EnsurePlatformTemplates(ctx, tx)
+	return wrapSeedErr("ensure platform templates", err)
 }
 
 func ensureBrand(ctx context.Context, tx pgx.Tx, tenantID int64) (int64, error) {

server/cmd/seed-platform-templates/main.go

@@ -0,0 +1,60 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/geo-platform/tenant-api/internal/shared/config"
+	"github.com/geo-platform/tenant-api/internal/tenant/prompts"
+	"github.com/geo-platform/tenant-api/internal/tenant/repository"
+)
+
+func main() {
+	configPath := "configs/config.yaml"
+	if p := strings.TrimSpace(os.Getenv("CONFIG_PATH")); p != "" {
+		configPath = p
+	}
+
+	cfg, err := config.Load(configPath)
+	if err != nil {
+		log.Fatalf("load config: %v", err)
+	}
+	if password := strings.TrimSpace(os.Getenv("POSTGRES_PASSWORD")); password != "" {
+		cfg.Database.Password = password
+	}
+	prompts.SetConfigFile(filepath.Join(filepath.Dir(configPath), "prompts.yml"))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	pool, err := pgxpool.New(ctx, cfg.Database.DSN())
+	if err != nil {
+		log.Fatalf("connect database: %v", err)
+	}
+	defer pool.Close()
+
+	tx, err := pool.Begin(ctx)
+	if err != nil {
+		log.Fatalf("begin transaction: %v", err)
+	}
+	defer func() {
+		_ = tx.Rollback(ctx)
+	}()
+
+	count, err := repository.EnsurePlatformTemplates(ctx, tx)
+	if err != nil {
+		log.Fatalf("ensure platform templates: %v", err)
+	}
+	if err := tx.Commit(ctx); err != nil {
+		log.Fatalf("commit platform templates: %v", err)
+	}
+
+	fmt.Printf("Platform templates ensured: %d\n", count)
+}