feat: Phase 7 — SeedService, SecretsService, ProvisioningService + ssh Provisioner

Seed ingest/export moves behind ports.SeedRepository (SeedRepo in the
postgres adapter; knowledge ingest absorbed from internal/knowledge,
package deleted). pct_create flow (defaults, template/VMID/gateway
pre-flights, pct create, graph registration) moves from httpapi's
approved-execution path into app.ProvisioningService + the ssh
provisioner adapter; CLI seed/export/secret become adapters over the
services. EntityCreateInput gains EnrolledAt. Plan status corrected:
phases 0-7 shipped, 8 + 9 gates open. VERSION 0.34.1.

internal/httpapi/api_test.go

@@ -19,6 +19,7 @@ import (
 	"github.com/dtoro/oikos/internal/config"
 	"github.com/dtoro/oikos/internal/adapters/postgres"
 	"github.com/dtoro/oikos/internal/core/app"
+	"github.com/dtoro/oikos/internal/core/ports/portstest"
 	"github.com/jackc/pgx/v5"
 )
 
@@ -97,7 +98,14 @@ func newTestHandler(t *testing.T, cfg config.Config) http.Handler {
 
 	repo := db.NewEntityRepo(pool)
 	onto := db.NewOntologyRepo(pool, time.Minute)
-	return NewHandler(handlerCtx, pool, cfg, app.NewEntityService(repo, onto), repo, db.NewEntityReader(pool), app.NewRelationshipService(db.NewRelRepo(pool), onto))
+	// Provisioning/seeds get real services over fakes/real repos: tests
+	// below don't exercise pct_create, but the export endpoint does hit
+	// SeedService, and a nil would panic.
+	provisioning := app.NewProvisioningService(
+		&portstest.FakeProvisioner{}, &portstest.FakeResolver{},
+		repo, db.NewRelRepo(pool))
+	seeds := app.NewSeedService(db.NewSeedRepo(pool))
+	return NewHandler(handlerCtx, pool, cfg, app.NewEntityService(repo, onto), repo, db.NewEntityReader(pool), app.NewRelationshipService(db.NewRelRepo(pool), onto), provisioning, seeds)
 }
 
 // testAuthToken is the static bearer token devConfig() configures. There is