feat: Phase 7 — SeedService, SecretsService, ProvisioningService + ssh Provisioner

Seed ingest/export moves behind ports.SeedRepository (SeedRepo in the
postgres adapter; knowledge ingest absorbed from internal/knowledge,
package deleted). pct_create flow (defaults, template/VMID/gateway
pre-flights, pct create, graph registration) moves from httpapi's
approved-execution path into app.ProvisioningService + the ssh
provisioner adapter; CLI seed/export/secret become adapters over the
services. EntityCreateInput gains EnrolledAt. Plan status corrected:
phases 0-7 shipped, 8 + 9 gates open. VERSION 0.34.1.

internal/core/ports/entities.go

@@ -60,6 +60,9 @@ type EntityCreateInput struct {
 	Audit         []AuditEntry
 	Event         *Event
 	Idempotency   *Idempotency
+	// EnrolledAt, when set, stamps the entities.enrolled_at column (the
+	// client-enrollment / provisioning marker). Zero for ordinary creates.
+	EnrolledAt *time.Time
 }
 
 // EntityUpdateInput mutates an entity atomically. ExpectedVersion is the