feat(server): add production-safe platform-template seed job

A fresh production environment only ran migrations, so the four built-in
platform templates were never inserted unless someone manually ran
dev-seed (which also writes broad demo data). Extract the platform
template upsert into a reusable repository.EnsurePlatformTemplates and
add a standalone cmd/seed-platform-templates that calls it. Bake the
binary into the migrate image and chain it after migrate up in both
docker-compose and the k3s migration job (mounting app config so the
binary can dial the right database).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/repository/platform_template_seed.go

@@ -0,0 +1,43 @@
+package repository
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/geo-platform/tenant-api/internal/tenant/prompts"
+	"github.com/geo-platform/tenant-api/internal/tenant/repository/generated"
+)
+
+func EnsurePlatformTemplates(ctx context.Context, db generated.DBTX) (int, error) {
+	seeds := prompts.PlatformTemplateSeeds()
+	for _, tpl := range seeds {
+		_, err := db.Exec(ctx, `
+			INSERT INTO article_templates (
+				scope,
+				tenant_id,
+				origin_type,
+				template_key,
+				template_name,
+				prompt_template,
+				prompt_visibility,
+				card_config_json,
+				status,
+				version_no
+			)
+			VALUES ('platform', NULL, 'platform', $1, $2, $3, 'visible', $4::jsonb, 'active', 1)
+			ON CONFLICT (scope, template_key, version_no)
+			WHERE deleted_at IS NULL AND tenant_id IS NULL
+			DO UPDATE SET
+				template_name = EXCLUDED.template_name,
+				prompt_template = EXCLUDED.prompt_template,
+				card_config_json = EXCLUDED.card_config_json,
+				prompt_visibility = 'visible',
+				status = 'active',
+				updated_at = NOW()
+		`, tpl.Key, tpl.Name, tpl.PromptTemplate, tpl.CardConfigJSON)
+		if err != nil {
+			return 0, fmt.Errorf("upsert platform template %q: %w", tpl.Key, err)
+		}
+	}
+	return len(seeds), nil
+}