feat(admin): cloudprov, the instance provisioning write path

Admin's second and final write path into the control plane. It creates
instances and users and nothing else; inject still owns exactly three
licence fields and is untouched.

The owner's password hash is copied from the HQ account, not shared. The
two diverge on the next password change, which is accepted: propagating a
hash across two databases is worse than two passwords that started equal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/internal/db/db.go

@@ -1,9 +1,11 @@
 // Package db holds admin's two MongoDB connections.
 //
 // Admin() is its own database and it owns every collection there. Control() is
-// the control plane's database, and admin's access to it is deliberately narrow:
-// it reads `instances` and `users`, and writes exactly three licence fields on
-// `instances`. Nothing here should ever grow a write path to another collection.
+// the control plane's database. Admin's access to it is narrow and lives in
+// exactly two packages: inject writes three licence fields on `instances`, and
+// cloudprov creates and rolls back `instances` and `users` when a customer
+// provisions a cloud instance. Nothing else may write there, and a third write
+// path is a design change rather than a refactor.
 package db
 
 import (
@@ -57,6 +59,13 @@ func Connect(ctx context.Context, cfg config.Config) error {
 func Admin(name string) *mongo.Collection   { return adminDB.Collection(name) }
 func Control(name string) *mongo.Collection { return controlDB.Collection(name) }
 
+// ControlDB exposes the control-plane database itself, because shared/provision
+// takes a database rather than a collection.
+//
+// It is used by cloudprov and nothing else. Reach for Control(name) unless you
+// are calling into shared/provision.
+func ControlDB() *mongo.Database { return controlDB }
+
 func Ctx() (context.Context, context.CancelFunc) {
 	return context.WithTimeout(context.Background(), 10*time.Second)
 }