refactor: prefix all third-party service names with cameleer-

Rename all Docker Compose service names, DNS hostnames, volumes,
and Traefik labels to use the cameleer- prefix for clear ownership.

Services renamed:
- postgres → cameleer-postgres
- clickhouse → cameleer-clickhouse
- logto → cameleer-logto
- traefik → cameleer-traefik

Volumes renamed:
- pgdata → cameleer-pgdata
- chdata → cameleer-chdata
- certs → cameleer-certs
- bootstrapdata → cameleer-bootstrapdata

Updated across:
- docker-compose.yml, docker-compose.dev.yml
- installer/cameleer/docker-compose.yml
- installer/install.sh, installer/install.ps1
- application.yml defaults
- DockerTenantProvisioner.java hardcoded URL
- logto-bootstrap.sh defaults
- VendorTenantServiceTest.java
- CLAUDE.md, docs/architecture.md, docs/user-manual.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

installer/install.sh

@@ -688,7 +688,7 @@ generate_compose_file() {
 # Generated by Cameleer installer <20> do not edit manually
 
 services:
-  traefik:
+  cameleer-traefik:
     image: ${TRAEFIK_IMAGE:-gitea.siegeln.net/cameleer/cameleer-traefik}:${VERSION:-latest}
     restart: unless-stopped
     ports:
@@ -709,7 +709,7 @@ EOF
       KEY_FILE: ${KEY_FILE:-}
       CA_FILE: ${CA_FILE:-}
     volumes:
-      - certs:/certs
+      - cameleer-certs:/certs
       - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
 EOF
 
@@ -737,7 +737,7 @@ EOF
 
   cat >> "$f" << 'EOF'
 
-  postgres:
+  cameleer-postgres:
     image: ${POSTGRES_IMAGE:-gitea.siegeln.net/cameleer/cameleer-postgres}:${VERSION:-latest}
     restart: unless-stopped
     environment:
@@ -745,7 +745,7 @@ EOF
       POSTGRES_USER: ${POSTGRES_USER:-cameleer}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
     volumes:
-      - pgdata:/var/lib/postgresql/data
+      - cameleer-pgdata:/var/lib/postgresql/data
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER:-cameleer} -d cameleer_saas"]
       interval: 5s
@@ -761,13 +761,13 @@ EOF
 
   cat >> "$f" << 'EOF'
 
-  clickhouse:
+  cameleer-clickhouse:
     image: ${CLICKHOUSE_IMAGE:-gitea.siegeln.net/cameleer/cameleer-clickhouse}:${VERSION:-latest}
     restart: unless-stopped
     environment:
       CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
     volumes:
-      - chdata:/var/lib/clickhouse
+      - cameleer-chdata:/var/lib/clickhouse
     healthcheck:
       test: ["CMD-SHELL", "clickhouse-client --password $${CLICKHOUSE_PASSWORD} --query 'SELECT 1'"]
       interval: 10s
@@ -789,24 +789,24 @@ EOF
 
   cat >> "$f" << 'EOF'
 
-  logto:
+  cameleer-logto:
     image: ${LOGTO_IMAGE:-gitea.siegeln.net/cameleer/cameleer-logto}:${VERSION:-latest}
     restart: unless-stopped
     depends_on:
-      postgres:
+      cameleer-postgres:
         condition: service_healthy
     environment:
-      DB_URL: postgres://${POSTGRES_USER:-cameleer}:${POSTGRES_PASSWORD}@postgres:5432/logto
+      DB_URL: postgres://${POSTGRES_USER:-cameleer}:${POSTGRES_PASSWORD}@cameleer-postgres:5432/logto
       ENDPOINT: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}
       ADMIN_ENDPOINT: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}:${LOGTO_CONSOLE_PORT:-3002}
       TRUST_PROXY_HEADER: 1
       NODE_TLS_REJECT_UNAUTHORIZED: "${NODE_TLS_REJECT:-0}"
-      LOGTO_ENDPOINT: http://logto:3001
-      LOGTO_ADMIN_ENDPOINT: http://logto:3002
+      LOGTO_ENDPOINT: http://cameleer-logto:3001
+      LOGTO_ADMIN_ENDPOINT: http://cameleer-logto:3002
       LOGTO_PUBLIC_ENDPOINT: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}
       PUBLIC_HOST: ${PUBLIC_HOST:-localhost}
       PUBLIC_PROTOCOL: ${PUBLIC_PROTOCOL:-https}
-      PG_HOST: postgres
+      PG_HOST: cameleer-postgres
       PG_USER: ${POSTGRES_USER:-cameleer}
       PG_PASSWORD: ${POSTGRES_PASSWORD}
       PG_DB_SAAS: cameleer_saas
@@ -820,32 +820,32 @@ EOF
       start_period: 30s
     labels:
       - traefik.enable=true
-      - traefik.http.routers.logto.rule=PathPrefix(`/`)
-      - traefik.http.routers.logto.priority=1
-      - traefik.http.routers.logto.entrypoints=websecure
-      - traefik.http.routers.logto.tls=true
-      - traefik.http.routers.logto.service=logto
-      - traefik.http.routers.logto.middlewares=logto-cors
-      - "traefik.http.middlewares.logto-cors.headers.accessControlAllowOriginList=${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}:${LOGTO_CONSOLE_PORT:-3002}"
-      - traefik.http.middlewares.logto-cors.headers.accessControlAllowMethods=GET,POST,PUT,PATCH,DELETE,OPTIONS
-      - traefik.http.middlewares.logto-cors.headers.accessControlAllowHeaders=Authorization,Content-Type
-      - traefik.http.middlewares.logto-cors.headers.accessControlAllowCredentials=true
-      - traefik.http.services.logto.loadbalancer.server.port=3001
+      - traefik.http.routers.cameleer-logto.rule=PathPrefix(`/`)
+      - traefik.http.routers.cameleer-logto.priority=1
+      - traefik.http.routers.cameleer-logto.entrypoints=websecure
+      - traefik.http.routers.cameleer-logto.tls=true
+      - traefik.http.routers.cameleer-logto.service=cameleer-logto
+      - traefik.http.routers.cameleer-logto.middlewares=cameleer-logto-cors
+      - "traefik.http.middlewares.cameleer-logto-cors.headers.accessControlAllowOriginList=${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}:${LOGTO_CONSOLE_PORT:-3002}"
+      - traefik.http.middlewares.cameleer-logto-cors.headers.accessControlAllowMethods=GET,POST,PUT,PATCH,DELETE,OPTIONS
+      - traefik.http.middlewares.cameleer-logto-cors.headers.accessControlAllowHeaders=Authorization,Content-Type
+      - traefik.http.middlewares.cameleer-logto-cors.headers.accessControlAllowCredentials=true
+      - traefik.http.services.cameleer-logto.loadbalancer.server.port=3001
 EOF
 
   if [ "$LOGTO_CONSOLE_EXPOSED" = "true" ]; then
     cat >> "$f" << 'EOF'
-      - traefik.http.routers.logto-console.rule=PathPrefix(`/`)
-      - traefik.http.routers.logto-console.entrypoints=admin-console
-      - traefik.http.routers.logto-console.tls=true
-      - traefik.http.routers.logto-console.service=logto-console
-      - traefik.http.services.logto-console.loadbalancer.server.port=3002
+      - traefik.http.routers.cameleer-logto-console.rule=PathPrefix(`/`)
+      - traefik.http.routers.cameleer-logto-console.entrypoints=admin-console
+      - traefik.http.routers.cameleer-logto-console.tls=true
+      - traefik.http.routers.cameleer-logto-console.service=cameleer-logto-console
+      - traefik.http.services.cameleer-logto-console.loadbalancer.server.port=3002
 EOF
   fi
 
   cat >> "$f" << 'EOF'
     volumes:
-      - bootstrapdata:/data
+      - cameleer-bootstrapdata:/data
     networks:
       - cameleer
 
@@ -853,15 +853,15 @@ EOF
     image: ${CAMELEER_IMAGE:-gitea.siegeln.net/cameleer/cameleer-saas}:${VERSION:-latest}
     restart: unless-stopped
     depends_on:
-      logto:
+      cameleer-logto:
         condition: service_healthy
     environment:
       # SaaS database
-      SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/cameleer_saas
+      SPRING_DATASOURCE_URL: jdbc:postgresql://cameleer-postgres:5432/cameleer_saas
       SPRING_DATASOURCE_USERNAME: ${POSTGRES_USER:-cameleer}
       SPRING_DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD}
       # Identity (Logto)
-      CAMELEER_SAAS_IDENTITY_LOGTOENDPOINT: http://logto:3001
+      CAMELEER_SAAS_IDENTITY_LOGTOENDPOINT: http://cameleer-logto:3001
       CAMELEER_SAAS_IDENTITY_LOGTOPUBLICENDPOINT: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}
       # Provisioning — passed to per-tenant server containers
       CAMELEER_SAAS_PROVISIONING_PUBLICHOST: ${PUBLIC_HOST:-localhost}
@@ -891,8 +891,8 @@ EOF
 
   cat >> "$f" << 'EOF'
     volumes:
-      - bootstrapdata:/data/bootstrap:ro
-      - certs:/certs
+      - cameleer-bootstrapdata:/data/bootstrap:ro
+      - cameleer-certs:/certs
       - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
     networks:
       - cameleer
@@ -912,10 +912,10 @@ EOF
 volumes:
 EOF
   cat >> "$f" << 'EOF'
-  pgdata:
-  chdata:
-  certs:
-  bootstrapdata:
+  cameleer-pgdata:
+  cameleer-chdata:
+  cameleer-certs:
+  cameleer-bootstrapdata:
 
 networks:
   cameleer:
@@ -944,7 +944,7 @@ generate_compose_file_standalone() {
 # Generated by Cameleer installer — do not edit manually
 
 services:
-  traefik:
+  cameleer-traefik:
     image: ${TRAEFIK_IMAGE:-gitea.siegeln.net/cameleer/cameleer-traefik}:${VERSION:-latest}
     restart: unless-stopped
     ports:
@@ -956,7 +956,7 @@ services:
       KEY_FILE: ${KEY_FILE:-}
       CA_FILE: ${CA_FILE:-}
     volumes:
-      - certs:/certs
+      - cameleer-certs:/certs
       - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
       - ./traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
 COMPOSEEOF
@@ -977,7 +977,7 @@ COMPOSEEOF
 
   cat >> "$f" << 'COMPOSEEOF'
 
-  postgres:
+  cameleer-postgres:
     image: postgres:16-alpine
     restart: unless-stopped
     environment:
@@ -985,7 +985,7 @@ COMPOSEEOF
       POSTGRES_USER: ${POSTGRES_USER:-cameleer}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
     volumes:
-      - pgdata:/var/lib/postgresql/data
+      - cameleer-pgdata:/var/lib/postgresql/data
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER:-cameleer} -d $${POSTGRES_DB:-cameleer3}"]
       interval: 5s
@@ -1001,13 +1001,13 @@ COMPOSEEOF
 
   cat >> "$f" << 'COMPOSEEOF'
 
-  clickhouse:
+  cameleer-clickhouse:
     image: ${CLICKHOUSE_IMAGE:-gitea.siegeln.net/cameleer/cameleer-clickhouse}:${VERSION:-latest}
     restart: unless-stopped
     environment:
       CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
     volumes:
-      - chdata:/var/lib/clickhouse
+      - cameleer-chdata:/var/lib/clickhouse
     healthcheck:
       test: ["CMD-SHELL", "clickhouse-client --password $${CLICKHOUSE_PASSWORD} --query 'SELECT 1'"]
       interval: 10s
@@ -1032,14 +1032,14 @@ COMPOSEEOF
     container_name: cameleer-server
     restart: unless-stopped
     depends_on:
-      postgres:
+      cameleer-postgres:
         condition: service_healthy
     environment:
       CAMELEER_SERVER_TENANT_ID: default
-      SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/\${POSTGRES_DB:-cameleer3}?currentSchema=tenant_default
+      SPRING_DATASOURCE_URL: jdbc:postgresql://cameleer-postgres:5432/\${POSTGRES_DB:-cameleer3}?currentSchema=tenant_default
       SPRING_DATASOURCE_USERNAME: \${POSTGRES_USER:-cameleer}
       SPRING_DATASOURCE_PASSWORD: \${POSTGRES_PASSWORD}
-      CAMELEER_SERVER_CLICKHOUSE_URL: jdbc:clickhouse://clickhouse:8123/cameleer
+      CAMELEER_SERVER_CLICKHOUSE_URL: jdbc:clickhouse://cameleer-clickhouse:8123/cameleer
       CAMELEER_SERVER_CLICKHOUSE_USERNAME: default
       CAMELEER_SERVER_CLICKHOUSE_PASSWORD: \${CLICKHOUSE_PASSWORD}
       CAMELEER_SERVER_SECURITY_BOOTSTRAPTOKEN: \${BOOTSTRAP_TOKEN}
@@ -1069,7 +1069,7 @@ COMPOSEEOF
       start_period: 30s
     volumes:
       - jars:/data/jars
-      - certs:/certs:ro
+      - cameleer-certs:/certs:ro
       - \${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
     group_add:
       - "${docker_gid}"
@@ -1102,9 +1102,9 @@ COMPOSEEOF
   cat >> "$f" << 'COMPOSEEOF'
 
 volumes:
-  pgdata:
-  chdata:
-  certs:
+  cameleer-pgdata:
+  cameleer-chdata:
+  cameleer-certs:
   jars:
 
 networks:
@@ -1425,19 +1425,19 @@ EOF
 
 | Docker Volume | Contains |
 |---|---|
-| \`pgdata\` | PostgreSQL data (tenants, licenses, audit) |
-| \`chdata\` | ClickHouse data (traces, metrics, logs) |
-| \`certs\` | TLS certificates |
-| \`bootstrapdata\` | Logto bootstrap results |
+| \`cameleer-pgdata\` | PostgreSQL data (tenants, licenses, audit) |
+| \`cameleer-chdata\` | ClickHouse data (traces, metrics, logs) |
+| \`cameleer-certs\` | TLS certificates |
+| \`cameleer-bootstrapdata\` | Logto bootstrap results |
 
 ### Backup Commands
 
 \`\`\`bash
 # PostgreSQL
-docker compose -p ${COMPOSE_PROJECT} exec postgres pg_dump -U cameleer cameleer_saas > backup.sql
+docker compose -p ${COMPOSE_PROJECT} exec cameleer-postgres pg_dump -U cameleer cameleer_saas > backup.sql
 
 # ClickHouse
-docker compose -p ${COMPOSE_PROJECT} exec clickhouse clickhouse-client --query "SELECT * FROM cameleer.traces FORMAT Native" > traces.native
+docker compose -p ${COMPOSE_PROJECT} exec cameleer-clickhouse clickhouse-client --query "SELECT * FROM cameleer.traces FORMAT Native" > traces.native
 \`\`\`
 
 ## Upgrading
@@ -1455,9 +1455,9 @@ The installer preserves your \`.env\`, credentials, and data volumes. Only the c
 | Issue | Command |
 |---|---|
 | Service not starting | \`docker compose -p ${COMPOSE_PROJECT} logs SERVICE_NAME\` |
-| Bootstrap failed | \`docker compose -p ${COMPOSE_PROJECT} logs logto\` |
-| Routing issues | \`docker compose -p ${COMPOSE_PROJECT} logs traefik\` |
-| Database issues | \`docker compose -p ${COMPOSE_PROJECT} exec postgres psql -U cameleer -d cameleer_saas\` |
+| Bootstrap failed | \`docker compose -p ${COMPOSE_PROJECT} logs cameleer-logto\` |
+| Routing issues | \`docker compose -p ${COMPOSE_PROJECT} logs cameleer-traefik\` |
+| Database issues | \`docker compose -p ${COMPOSE_PROJECT} exec cameleer-postgres psql -U cameleer -d cameleer_saas\` |
 
 ## Uninstalling
 
@@ -1556,19 +1556,19 @@ EOF
 
 | Docker Volume | Contains |
 |---|---|
-| \`pgdata\` | PostgreSQL data (server config, routes, deployments) |
-| \`chdata\` | ClickHouse data (traces, metrics, logs) |
-| \`certs\` | TLS certificates |
+| \`cameleer-pgdata\` | PostgreSQL data (server config, routes, deployments) |
+| \`cameleer-chdata\` | ClickHouse data (traces, metrics, logs) |
+| \`cameleer-certs\` | TLS certificates |
 | \`jars\` | Uploaded application JARs |
 
 ### Backup Commands
 
 \`\`\`bash
 # PostgreSQL
-docker compose -p ${COMPOSE_PROJECT} exec postgres pg_dump -U cameleer cameleer3 > backup.sql
+docker compose -p ${COMPOSE_PROJECT} exec cameleer-postgres pg_dump -U cameleer cameleer3 > backup.sql
 
 # ClickHouse
-docker compose -p ${COMPOSE_PROJECT} exec clickhouse clickhouse-client --query "SELECT * FROM cameleer.traces FORMAT Native" > traces.native
+docker compose -p ${COMPOSE_PROJECT} exec cameleer-clickhouse clickhouse-client --query "SELECT * FROM cameleer.traces FORMAT Native" > traces.native
 \`\`\`
 
 ## Upgrading
@@ -1587,8 +1587,8 @@ The installer preserves your \`.env\`, credentials, and data volumes. Only the c
 |---|---|
 | Service not starting | \`docker compose -p ${COMPOSE_PROJECT} logs SERVICE_NAME\` |
 | Server issues | \`docker compose -p ${COMPOSE_PROJECT} logs server\` |
-| Routing issues | \`docker compose -p ${COMPOSE_PROJECT} logs traefik\` |
-| Database issues | \`docker compose -p ${COMPOSE_PROJECT} exec postgres psql -U cameleer -d cameleer3\` |
+| Routing issues | \`docker compose -p ${COMPOSE_PROJECT} logs cameleer-traefik\` |
+| Database issues | \`docker compose -p ${COMPOSE_PROJECT} exec cameleer-postgres psql -U cameleer -d cameleer3\` |
 
 ## Uninstalling