feat(server): add production-safe platform-template seed job

A fresh production environment only ran migrations, so the four built-in
platform templates were never inserted unless someone manually ran
dev-seed (which also writes broad demo data). Extract the platform
template upsert into a reusable repository.EnsurePlatformTemplates and
add a standalone cmd/seed-platform-templates that calls it. Bake the
binary into the migrate image and chain it after migrate up in both
docker-compose and the k3s migration job (mounting app config so the
binary can dial the right database).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/cmd/dev-seed/main.go

@@ -485,33 +485,8 @@ func ensureQuotaLedger(ctx context.Context, tx pgx.Tx, tenantID int64, total int
 }
 
 func ensureTemplates(ctx context.Context, tx pgx.Tx) error {
-	for _, tpl := range prompts.PlatformTemplateSeeds() {
-		_, err := tx.Exec(ctx, `
-			INSERT INTO article_templates (scope, origin_type, template_key, template_name, prompt_template, prompt_visibility, card_config_json, status)
-			VALUES ('platform', 'platform', $1, $2, $3, 'visible', $4::jsonb, 'active')
-			ON CONFLICT DO NOTHING
-		`, tpl.Key, tpl.Name, tpl.PromptTemplate, tpl.CardConfigJSON)
-		if err != nil {
-			return wrapSeedErr("insert template", err)
-		}
-
-		_, err = tx.Exec(ctx, `
-			UPDATE article_templates
-			SET template_name = $2,
-				prompt_template = $3,
-				card_config_json = $4::jsonb,
-				prompt_visibility = 'visible',
-				status = 'active',
-				updated_at = NOW()
-			WHERE scope = 'platform'
-			  AND template_key = $1
-			  AND deleted_at IS NULL
-		`, tpl.Key, tpl.Name, tpl.PromptTemplate, tpl.CardConfigJSON)
-		if err != nil {
-			return wrapSeedErr("update template", err)
-		}
-	}
-	return nil
+	_, err := repository.EnsurePlatformTemplates(ctx, tx)
+	return wrapSeedErr("ensure platform templates", err)
 }
 
 func ensureBrand(ctx context.Context, tx pgx.Tx, tenantID int64) (int64, error) {