feat: Phase 7 — SeedService, SecretsService, ProvisioningService + ssh Provisioner

Seed ingest/export moves behind ports.SeedRepository (SeedRepo in the
postgres adapter; knowledge ingest absorbed from internal/knowledge,
package deleted). pct_create flow (defaults, template/VMID/gateway
pre-flights, pct create, graph registration) moves from httpapi's
approved-execution path into app.ProvisioningService + the ssh
provisioner adapter; CLI seed/export/secret become adapters over the
services. EntityCreateInput gains EnrolledAt. Plan status corrected:
phases 0-7 shipped, 8 + 9 gates open. VERSION 0.34.1.

internal/adapters/postgres/repositories.go

@@ -259,10 +259,10 @@ func (r *EntityRepo) Create(ctx context.Context, in ports.EntityCreateInput) (do
 	}
 
 	created, err := scanDomainEntity(tx.QueryRow(ctx, `
-		INSERT INTO entities (id, slug, type, name, state, attributes)
-		VALUES ($1, $2, $3, $4, $5, $6)
+		INSERT INTO entities (id, slug, type, name, state, attributes, enrolled_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7)
 		RETURNING `+entityFullCols,
-		mustUUID(e.ID), e.Slug, e.Type, e.Name, state, attrsJSON))
+		mustUUID(e.ID), e.Slug, e.Type, e.Name, state, attrsJSON, in.EnrolledAt))
 	if err != nil {
 		if strings.Contains(err.Error(), "unique") || strings.Contains(err.Error(), "duplicate") {
 			return domain.Entity{}, errors.Join(domain.ErrAlreadyExists, err)