feat: streamline platform and secure data access

- move the relational data center to MySQL and a standalone workbench\n- add Interface Center API credentials, policies, logs, and DBeaver SSH guidance\n- harden authentication and deployment while retiring unused management surfaces

docker/mysql-init/01-data-center-grants.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+# The database code is the physical MySQL database name, so project databases
+# do not share a technical prefix. Grant the non-administrative DDL/DML set
+# globally, then use MySQL partial revokes to exclude the mutable mysql schema
+# and sys views. information_schema and performance_schema are server-managed
+# read-only schemas, and the SQL console also blocks every system schema. The
+# dedicated platform_control database remains available to the service.
+mysql --protocol=socket -uroot -p"${MYSQL_ROOT_PASSWORD}" -e \
+  "GRANT CREATE, DROP, ALTER, INDEX, REFERENCES, SELECT, INSERT, UPDATE, DELETE, CREATE VIEW, SHOW VIEW, TRIGGER ON *.* TO '${MYSQL_USER}'@'%';
+   REVOKE CREATE, DROP, ALTER, INDEX, REFERENCES, SELECT, INSERT, UPDATE, DELETE, CREATE VIEW, SHOW VIEW, TRIGGER ON \`mysql\`.* FROM '${MYSQL_USER}'@'%';
+   REVOKE CREATE, DROP, ALTER, INDEX, REFERENCES, SELECT, INSERT, UPDATE, DELETE, CREATE VIEW, SHOW VIEW, TRIGGER ON \`sys\`.* FROM '${MYSQL_USER}'@'%';
+   FLUSH PRIVILEGES;"