Move Environment Templates out of store into environmenttemplates and templatepg

[SaladDay]

Part of #1 (store layering), PR 9: Environment Templates move out of store.

• environmenttemplates domain package: the Template vocabulary, input and list rules, a Service for create/update/delete, and Storage/Reader ports. Reader.Resolve returns the decrypted configuration used at Session creation.
• persistence/postgres/templatepg: the PostgreSQL adapter. It seals the setup and initial files with the credential key, and it records write audits in the same transaction via auditpg. With no confidential fields, no key is needed.
• api: EnvironmentTemplates (service) and EnvironmentTemplatesReader (adapter) Dependencies fields, strict fakes, and the templates error writer.
• cmd/server: wires templatepg.New(units, credentialKey) and environmenttemplates.NewService.
• Deleted from store: environment_templates.go, the template-only environment_plugins.go/environment_skills.go, and their tests. Coverage moved to environmenttemplates/templatepg.

Behaviour change: when the credential key is missing, writing or resolving a Template with encrypted setup or files now returns 503 credential_storage_unavailable instead of 500. Get and List still work without a key.

Checks on the final head (2415c42 + 2):

• go build ./... and go vet ./services/core/... across the whole module
• environmenttemplates and templatepg in full; api and cmd/server
• store: -run only (the conflicted audit test files and the initial-files test)
• make openapi (no diff) and scripts/check-names.py

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}