Support data-plane selection and colocated trial storage in tenantCreate

[GregorShear]

Description:

Reimplements the signup data-plane selection work from #3318 on top of tenantCreate (#3542) and its current MSA consent flow. Adds an optional dataPlane argument, validates that it names an open public plane, and orders tenant storage mappings with the selected plane first. When omitted, selection prefers ops/dp/public/aws-us-east-1-c2, falling back to the newest open public plane if that default is unavailable.

Adds colocated AWS trial storage for collection and recovery mappings, and closes the deprecated GCP us-central1 c1/c2 planes to new signup selection. Tenant provisioning, storage mappings, and MSA consent commit atomically.

Workflow steps:

• Optionally pass dataPlane directly to tenantCreate alongside the existing name, MSA terms ID, and optional survey arguments.
• Public AWS planes always use their derived colocated S3 trial bucket. Provision the bucket and its permissions before opening a plane for signup. Local and non-AWS planes continue to use the existing GCS trial bucket.

Documentation links affected:

Updates crates/control-plane-api/README.md and the checked-in GraphQL schema. No external documentation changes included.

Notes for reviewers:

• Legacy directive provisioning retains its existing behavior.
• Includes storage selection/bucket-name tests and tenant creation tests for selection, unavailable planes, and colocated storage; retains the current consent tests.
• cargo fmt and git diff --check passed.
• Regenerated the GraphQL schema successfully with mise exec -- cargo build -p flow-client --features generate in Lima.
• In Lima, mise exec -- cargo nextest run -p control-plane-api -E 'test(server::public::graphql::tenant::)' passed all 14 tenant tests, including omitted/default data-plane selection.