feat: clean control plane — remove all example tenant resources

- Removed cameleer3-server and cameleer3-server-ui from docker-compose
  (tenants provision their own server instances via the vendor console)
- Removed viewer/camel user from bootstrap (tenant users created during
  provisioning)
- Removed Phase 7 server OIDC configuration (provisioned servers get
  OIDC config from env vars, claim mappings via Logto Custom JWT)
- Removed server-related env vars from bootstrap (SERVER_ENDPOINT, etc.)
- Removed jardata volume from dev overlay

Clean slate: docker compose up gives you Traefik + PostgreSQL +
ClickHouse + Logto + SaaS platform + vendor seed. Everything else
(servers, tenants, users) created through the vendor console.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -103,8 +103,6 @@ services:
     depends_on:
       logto:
         condition: service_healthy
-      cameleer3-server:
-        condition: service_healthy
     restart: "no"
     entrypoint: ["sh", "/scripts/logto-bootstrap.sh"]
     environment:
@@ -119,12 +117,6 @@ services:
       PG_DB_SAAS: ${POSTGRES_DB:-cameleer_saas}
       SAAS_ADMIN_USER: ${SAAS_ADMIN_USER:-admin}
       SAAS_ADMIN_PASS: ${SAAS_ADMIN_PASS:-admin}
-      TENANT_ADMIN_USER: ${TENANT_ADMIN_USER:-camel}
-      TENANT_ADMIN_PASS: ${TENANT_ADMIN_PASS:-camel}
-      CAMELEER_AUTH_TOKEN: ${CAMELEER_AUTH_TOKEN:-default-bootstrap-token}
-      SERVER_ENDPOINT: http://cameleer3-server:8081
-      SERVER_UI_USER: ${CAMELEER_UI_USER:-admin}
-      SERVER_UI_PASS: ${CAMELEER_UI_PASSWORD:-admin}
     volumes:
       - ./docker/logto-bootstrap.sh:/scripts/logto-bootstrap.sh:ro
       - bootstrapdata:/data
@@ -151,7 +143,6 @@ services:
       LOGTO_JWK_SET_URI: ${LOGTO_ENDPOINT:-http://logto:3001}/oidc/jwks
       LOGTO_M2M_CLIENT_ID: ${LOGTO_M2M_CLIENT_ID:-}
       LOGTO_M2M_CLIENT_SECRET: ${LOGTO_M2M_CLIENT_SECRET:-}
-      CAMELEER3_SERVER_ENDPOINT: http://cameleer3-server:8081
     labels:
       - traefik.enable=true
       - traefik.http.routers.saas.rule=PathPrefix(`/platform`)
@@ -161,62 +152,6 @@ services:
     networks:
       - cameleer
 
-  cameleer3-server:
-    image: ${CAMELEER3_SERVER_IMAGE:-gitea.siegeln.net/cameleer/cameleer3-server}:${VERSION:-latest}
-    restart: unless-stopped
-    depends_on:
-      postgres:
-        condition: service_healthy
-      clickhouse:
-        condition: service_started
-    environment:
-      SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/cameleer3
-      SPRING_DATASOURCE_USERNAME: ${POSTGRES_USER:-cameleer}
-      SPRING_DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD:-cameleer_dev}
-      CLICKHOUSE_URL: jdbc:clickhouse://clickhouse:8123/cameleer
-      CAMELEER_AUTH_TOKEN: ${CAMELEER_AUTH_TOKEN:-default-bootstrap-token}
-      CAMELEER_JWT_SECRET: ${CAMELEER_JWT_SECRET:-cameleer-dev-jwt-secret-change-in-production}
-      CAMELEER_TENANT_ID: ${CAMELEER_TENANT_SLUG:-default}
-      CAMELEER_OIDC_ISSUER_URI: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}/oidc
-      CAMELEER_OIDC_JWK_SET_URI: ${LOGTO_ENDPOINT:-http://logto:3001}/oidc/jwks
-      CAMELEER_OIDC_TLS_SKIP_VERIFY: "true"  # dev only — disable in production with real certs
-      CAMELEER_OIDC_AUDIENCE: ${CAMELEER_OIDC_AUDIENCE:-https://api.cameleer.local}
-      CAMELEER_CORS_ALLOWED_ORIGINS: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}
-    healthcheck:
-      test: ["CMD-SHELL", "curl -sf http://localhost:8081/api/v1/health || exit 1"]
-      interval: 5s
-      timeout: 5s
-      retries: 30
-      start_period: 15s
-    labels:
-      - traefik.enable=false
-    networks:
-      cameleer:
-      cameleer-traefik:
-        aliases:
-          - cameleer3-server
-
-  cameleer3-server-ui:
-    image: ${CAMELEER3_SERVER_UI_IMAGE:-gitea.siegeln.net/cameleer/cameleer3-server-ui}:${VERSION:-latest}
-    restart: unless-stopped
-    depends_on:
-      cameleer3-server:
-        condition: service_healthy
-    environment:
-      CAMELEER_API_URL: http://cameleer3-server:8081
-      BASE_PATH: /server
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.server-ui.rule=PathPrefix(`/server`)
-      - traefik.http.routers.server-ui.entrypoints=websecure
-      - traefik.http.routers.server-ui.tls=true
-      - traefik.http.routers.server-ui.middlewares=server-ui-strip
-      - traefik.http.middlewares.server-ui-strip.stripprefix.prefixes=/server
-      - traefik.http.routers.server-ui.service=server-ui
-      - traefik.http.services.server-ui.loadbalancer.server.port=80
-    networks:
-      - cameleer
-
   clickhouse:
     image: clickhouse/clickhouse-server:latest
     restart: unless-stopped