refactor: decompose CLAUDE.md into directory-scoped files

Root CLAUDE.md reduced from 475 to 175 lines (75 excl. GitNexus).
Detailed context now loads automatically only when editing code in
the relevant directory:

- provisioning/CLAUDE.md — env vars, provisioning flow, lifecycle
- config/CLAUDE.md — auth, scopes, JWT, OIDC role extraction
- docker/CLAUDE.md — routing, networks, bootstrap, deployment pipeline
- installer/CLAUDE.md — deployment modes, compose templates, env naming
- ui/CLAUDE.md — frontend files, sign-in UI

No information lost — everything moved, nothing deleted.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/CLAUDE.md

@@ -0,0 +1,30 @@
+# Frontend
+
+React 19 SPA served at `/platform/*` by the Spring Boot backend.
+
+## Core files
+
+- `main.tsx` — React 19 root
+- `router.tsx` — `/vendor/*` + `/tenant/*` with `RequireScope` guards and `LandingRedirect` that waits for scopes
+- `Layout.tsx` — persona-aware sidebar: vendor sees expandable "Vendor" section (Tenants, Audit Log, Certificates, Infrastructure, Identity/Logto), tenant admin sees Dashboard/License/SSO/Team/Audit/Settings
+- `OrgResolver.tsx` — merges global + org-scoped token scopes (vendor's platform:admin is global)
+- `config.ts` — fetch Logto config from /platform/api/config
+
+## Auth hooks
+
+- `auth/useAuth.ts` — auth hook (isAuthenticated, logout, signIn)
+- `auth/useOrganization.ts` — Zustand store for current tenant
+- `auth/useScopes.ts` — decode JWT scopes, hasScope()
+- `auth/ProtectedRoute.tsx` — guard (redirects to /login)
+
+## Pages
+
+- **Vendor pages**: `VendorTenantsPage.tsx`, `CreateTenantPage.tsx`, `TenantDetailPage.tsx`, `VendorAuditPage.tsx`, `CertificatesPage.tsx`, `InfrastructurePage.tsx`
+- **Tenant pages**: `TenantDashboardPage.tsx` (restart + upgrade server), `TenantLicensePage.tsx`, `SsoPage.tsx`, `TeamPage.tsx` (reset member passwords), `TenantAuditPage.tsx`, `SettingsPage.tsx` (change own password, reset server admin password)
+
+## Custom Sign-in UI (`ui/sign-in/`)
+
+Separate Vite+React SPA replacing Logto's default sign-in page. Built as custom Logto Docker image — see `docker/CLAUDE.md` for details.
+
+- `SignInPage.tsx` — form with @cameleer/design-system components
+- `experience-api.ts` — Logto Experience API client (4-step: init -> verify -> identify -> submit)