feat: Phase 7 — SeedService, SecretsService, ProvisioningService + ssh Provisioner

Seed ingest/export moves behind ports.SeedRepository (SeedRepo in the
postgres adapter; knowledge ingest absorbed from internal/knowledge,
package deleted). pct_create flow (defaults, template/VMID/gateway
pre-flights, pct create, graph registration) moves from httpapi's
approved-execution path into app.ProvisioningService + the ssh
provisioner adapter; CLI seed/export/secret become adapters over the
services. EntityCreateInput gains EnrolledAt. Plan status corrected:
phases 0-7 shipped, 8 + 9 gates open. VERSION 0.34.1.

internal/httpapi/server.go

@@ -69,6 +69,11 @@ type Server struct {
 	entityRepo  *db.EntityRepo
 	readModels  ports.ReadModels
 	relService  *app.RelationshipService
+	// provisioning owns the pct_create flow (Phase 7): spec defaults,
+	// provisioner dispatch, guest registration in the graph.
+	provisioning *app.ProvisioningService
+	// seeds regenerates seed YAMLs for the export endpoint (Phase 7).
+	seeds *app.SeedService
 }
 
 // NewHandler builds the full HTTP handler: /healthz (unauthenticated,
@@ -78,17 +83,19 @@ type Server struct {
 // holds a dedicated pooled connection for LISTEN. Callers MUST cancel ctx
 // before closing the pool — otherwise the held connection never releases
 // and pool.Close() deadlocks.
-func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config, entities *app.EntityService, entityRepo *db.EntityRepo, readModels ports.ReadModels, relService *app.RelationshipService) http.Handler {
+func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config, entities *app.EntityService, entityRepo *db.EntityRepo, readModels ports.ReadModels, relService *app.RelationshipService, provisioning *app.ProvisioningService, seeds *app.SeedService) http.Handler {
 	s := &Server{
-		pool:        pool,
-		cfg:         cfg,
-		entityCache: db.NewEntityCache(60 * time.Second),
-		sseBroker:   newSSEBroker(10000),
-		sseSubs:     make(map[*sseSubscriber]struct{}),
-		entities:    entities,
-		entityRepo:  entityRepo,
-		readModels:  readModels,
-		relService:  relService,
+		pool:         pool,
+		cfg:          cfg,
+		entityCache:  db.NewEntityCache(60 * time.Second),
+		sseBroker:    newSSEBroker(10000),
+		sseSubs:      make(map[*sseSubscriber]struct{}),
+		entities:     entities,
+		entityRepo:   entityRepo,
+		readModels:   readModels,
+		relService:   relService,
+		provisioning: provisioning,
+		seeds:        seeds,
 	}
 
 	// Wire secrets backend: Infisical primary with SOPS DR fallback.
@@ -937,10 +944,10 @@ main();
 
 // ListenAndServe runs the API server with graceful shutdown on ctx cancel
 // (SG4): stop accepting, drain in-flight for up to 30s, then exit.
-func ListenAndServe(ctx context.Context, pool *db.Pool, cfg config.Config, entities *app.EntityService, entityRepo *db.EntityRepo, readModels ports.ReadModels, relService *app.RelationshipService) error {
+func ListenAndServe(ctx context.Context, pool *db.Pool, cfg config.Config, entities *app.EntityService, entityRepo *db.EntityRepo, readModels ports.ReadModels, relService *app.RelationshipService, provisioning *app.ProvisioningService, seeds *app.SeedService) error {
 	srv := &http.Server{
 		Addr:              cfg.APIListen,
-		Handler:           NewHandler(ctx, pool, cfg, entities, entityRepo, readModels, relService),
+		Handler:           NewHandler(ctx, pool, cfg, entities, entityRepo, readModels, relService, provisioning, seeds),
 		ReadHeaderTimeout: 10 * time.Second,
 	}