feat: Fix multi-service deployment setup

[nfebe]

Make first deployments work for ordinary multi-service stacks without manual host access. Failed operations now return useful outcomes. They no longer leave deployments locked or partially configured.

[sourceant]

Code Review Summary

This PR significantly improves deployment reliability and security, particularly for multi-service stacks. It introduces better environment variable management, reliable domain transitions with rollbacks, enhanced database provisioning for PostgreSQL, and robust bind mount ownership handling with security guards against symlink attacks.

🚀 Key Improvements

• Migration to .env as the principal environment file with full backward compatibility for .env.flatrun.
• Atomic domain operations with rollback logic to prevent orphaned metadata or partial configurations on failure.
• Improved PostgreSQL support where provisioned users are granted proper ownership of the public schema, allowing table creation without manual host access.
• Introduction of one-shot service jobs and standardized timeouts for deployment actions to prevent indefinite blocking.
• Enhanced security for bind mounts through path validation and symlink traversal checks during ownership updates.
• Expanded OpenAPI metadata including x-plan-supported markers and enum values for database and action configurations.

💡 Minor Suggestions

• The normalization of database types (postgres vs postgresql) is slightly divergent between the API layer and the database manager. While handled correctly at the boundaries, consolidating this into a shared package could improve consistency.

[sourceant]

Review complete. No specific code suggestions were generated. See the overview comment for a summary.