diff --git a/.gitignore b/.gitignore
index a928ab0..ed65d4a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,6 +28,9 @@ Thumbs.db
 .playwright-mcp/
 .gitnexus
 
+# Installer output (generated by install.sh / install.ps1)
+installer/cameleer/
+
 # Generated by postinstall from @cameleer/design-system
 ui/public/favicon.svg
 docker/runtime-base/agent.jar
diff --git a/installer/cameleer/.env.bak b/installer/cameleer/.env.bak
deleted file mode 100644
index 230e96b..0000000
--- a/installer/cameleer/.env.bak
+++ /dev/null
@@ -1,33 +0,0 @@
-# Cameleer SaaS Configuration
-# Generated by installer v1.0.0 on 2026-04-15 08:55:30 UTC
- 
-VERSION=latest
- 
-PUBLIC_HOST=desktop-fb5vgj9.siegeln.internal
-PUBLIC_PROTOCOL=https
- 
-HTTP_PORT=80
-HTTPS_PORT=443
-LOGTO_CONSOLE_PORT=3002
- 
-# PostgreSQL
-POSTGRES_USER=cameleer
-POSTGRES_PASSWORD=dwnyYXj3bVe6kFcOHERr57SkrkD9476a
-POSTGRES_DB=cameleer_saas
- 
-# ClickHouse
-CLICKHOUSE_PASSWORD=SshXE61qZqB1kVoZpQLbr2mDYokw1ZgJ
- 
-# Admin user
-SAAS_ADMIN_USER=admin
-SAAS_ADMIN_PASS=1J3TrbgIYZbxjav1K14uy5DX8nil6Bdi
- 
-# TLS
-NODE_TLS_REJECT=0 
-# Docker
-DOCKER_SOCKET=/var/run/docker.sock
-DOCKER_GID=0
- 
-# Provisioning images
-CAMELEER_SAAS_PROVISIONING_SERVERIMAGE=gitea.siegeln.net/cameleer/cameleer-server:latest
-CAMELEER_SAAS_PROVISIONING_SERVERUIIMAGE=gitea.siegeln.net/cameleer/cameleer-server-ui:latest
\ No newline at end of file
diff --git a/installer/cameleer/INSTALL.md b/installer/cameleer/INSTALL.md
deleted file mode 100644
index afb5bf7..0000000
--- a/installer/cameleer/INSTALL.md
+++ /dev/null
@@ -1,95 +0,0 @@
-# Cameleer SaaS -- Installation Documentation
- 
-## Installation Summary
- 
-| | |
-|---|---|
-| **Version** | latest |
-| **Date** | 2026-04-15 08:55:55 UTC |
-| **Installer** | v1.0.0 |
-| **Install Directory** | C:\Users\Hendrik\Documents\projects\cameleer-saas\installer\cameleer |
-| **Hostname** | desktop-fb5vgj9.siegeln.internal |
-| **TLS** | Self-signed (auto-generated) |
- 
-## Service URLs
- 
-- **Platform UI:** https://desktop-fb5vgj9.siegeln.internal/platform/
-- **API Endpoint:** https://desktop-fb5vgj9.siegeln.internal/platform/api/
-- **Logto Admin Console:** https://desktop-fb5vgj9.siegeln.internal:3002
- 
-## First Steps
- 
-1. Open the Platform UI in your browser
-2. Log in as admin with the credentials from `credentials.txt`
-3. Create tenants from the admin console
-4. The platform will provision a dedicated server instance for each tenant
- 
-## Architecture
- 
-| Container | Purpose |
-|---|---|
-| `traefik` | Reverse proxy, TLS termination, routing |
-| `postgres` | PostgreSQL database (SaaS + Logto + tenant schemas) |
-| `clickhouse` | Time-series storage (traces, metrics, logs) |
-| `logto` | OIDC identity provider + bootstrap |
-| `cameleer-saas` | SaaS platform (Spring Boot + React) |
- 
-Per-tenant `cameleer-server` and `cameleer-server-ui` containers are provisioned dynamically.
- 
-## Networking
- 
-| Port | Service |
-|---|---|
-| 80 | HTTP (redirects to HTTPS) |
-| 443 | HTTPS (main entry point) |
-| 3002 | Logto Admin Console |
-
- 
-## TLS
- 
-**Mode:** Self-signed (auto-generated)
- 
-The platform generated a self-signed certificate on first boot. To replace it:
-1. Log in as admin and navigate to **Certificates** in the admin console
-2. Upload your certificate and key via the UI
-3. Activate the new certificate (zero-downtime swap)
- 
-## Data & Backups
- 
-| Docker Volume | Contains |
-|---|---|
-| `cameleer-pgdata` | PostgreSQL data (tenants, licenses, audit) |
-| `cameleer-chdata` | ClickHouse data (traces, metrics, logs) |
-| `cameleer-certs` | TLS certificates |
-| `cameleer-bootstrapdata` | Logto bootstrap results |
- 
-### Backup Commands
- 
-```bash
-docker compose -p cameleer-saas exec cameleer-postgres pg_dump -U cameleer cameleer_saas > backup.sql
-docker compose -p cameleer-saas exec cameleer-clickhouse clickhouse-client --query "SELECT * FROM cameleer.traces FORMAT Native" > traces.native
-```
- 
-## Upgrading
- 
-```powershell
-.\install.ps1 -InstallDir C:\Users\Hendrik\Documents\projects\cameleer-saas\installer\cameleer -Version NEW_VERSION
-```
- 
-## Troubleshooting
- 
-| Issue | Command |
-|---|---|
-| Service not starting | `docker compose -p cameleer-saas logs SERVICE_NAME` |
-| Bootstrap failed | `docker compose -p cameleer-saas logs cameleer-logto` |
-| Routing issues | `docker compose -p cameleer-saas logs cameleer-traefik` |
-| Database issues | `docker compose -p cameleer-saas exec cameleer-postgres psql -U cameleer -d cameleer_saas` |
- 
-## Uninstalling
- 
-```powershell
-Set-Location C:\Users\Hendrik\Documents\projects\cameleer-saas\installer\cameleer
-docker compose -p cameleer-saas down
-docker compose -p cameleer-saas down -v
-Remove-Item -Recurse -Force C:\Users\Hendrik\Documents\projects\cameleer-saas\installer\cameleer
-```
\ No newline at end of file
diff --git a/installer/cameleer/cameleer.conf b/installer/cameleer/cameleer.conf
deleted file mode 100644
index e862f96..0000000
--- a/installer/cameleer/cameleer.conf
+++ /dev/null
@@ -1,18 +0,0 @@
-# Cameleer installation config
-# Generated by installer v1.0.0 on 2026-04-15 08:55:30 UTC
- 
-install_dir=C:\Users\Hendrik\Documents\projects\cameleer-saas\installer\cameleer
-public_host=desktop-fb5vgj9.siegeln.internal
-public_protocol=https
-admin_user=admin
-tls_mode=self-signed
-http_port=80
-https_port=443
-logto_console_port=3002
-logto_console_exposed=true
-monitoring_network=
-version=latest
-compose_project=cameleer-saas
-docker_socket=/var/run/docker.sock
-node_tls_reject=0
-deployment_mode=saas
\ No newline at end of file
diff --git a/installer/cameleer/credentials.txt b/installer/cameleer/credentials.txt
deleted file mode 100644
index db47b3c..0000000
--- a/installer/cameleer/credentials.txt
+++ /dev/null
@@ -1,16 +0,0 @@
-===========================================
- CAMELEER PLATFORM CREDENTIALS
- Generated: 2026-04-15 08:55:55 UTC
- 
- SECURE THIS FILE AND DELETE AFTER NOTING
- THESE CREDENTIALS CANNOT BE RECOVERED
-===========================================
- 
-Admin Console:  https://desktop-fb5vgj9.siegeln.internal/platform/
-Admin User:     admin
-Admin Password: 1J3TrbgIYZbxjav1K14uy5DX8nil6Bdi
- 
-PostgreSQL:     cameleer / dwnyYXj3bVe6kFcOHERr57SkrkD9476a
-ClickHouse:     default / SshXE61qZqB1kVoZpQLbr2mDYokw1ZgJ
- 
-Logto Console:  https://desktop-fb5vgj9.siegeln.internal:3002
\ No newline at end of file
diff --git a/installer/cameleer/docker-compose.yml b/installer/cameleer/docker-compose.yml
deleted file mode 100644
index 7d30034..0000000
--- a/installer/cameleer/docker-compose.yml
+++ /dev/null
@@ -1,155 +0,0 @@
-# Cameleer SaaS Platform
-# Generated by Cameleer installer -- do not edit manually
- 
-services:
-  cameleer-traefik:
-    image: ${TRAEFIK_IMAGE:-gitea.siegeln.net/cameleer/cameleer-traefik}:${VERSION:-latest}
-    restart: unless-stopped
-    ports:
-      - "${HTTP_PORT:-80}:80"
-      - "${HTTPS_PORT:-443}:443"
-      - "${LOGTO_CONSOLE_PORT:-3002}:3002"
-    environment:
-      PUBLIC_HOST: ${PUBLIC_HOST:-localhost}
-      CERT_FILE: ${CERT_FILE:-}
-      KEY_FILE: ${KEY_FILE:-}
-      CA_FILE: ${CA_FILE:-}
-    volumes:
-      - cameleer-certs:/certs
-      - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
-    networks:
-      - cameleer
-      - cameleer-traefik
- 
-  cameleer-postgres:
-    image: ${POSTGRES_IMAGE:-gitea.siegeln.net/cameleer/cameleer-postgres}:${VERSION:-latest}
-    restart: unless-stopped
-    environment:
-      POSTGRES_DB: cameleer_saas
-      POSTGRES_USER: ${POSTGRES_USER:-cameleer}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-    volumes:
-      - cameleer-pgdata:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER:-cameleer} -d cameleer_saas"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    networks:
-      - cameleer
- 
-  cameleer-clickhouse:
-    image: ${CLICKHOUSE_IMAGE:-gitea.siegeln.net/cameleer/cameleer-clickhouse}:${VERSION:-latest}
-    restart: unless-stopped
-    environment:
-      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
-    volumes:
-      - cameleer-chdata:/var/lib/clickhouse
-    healthcheck:
-      test: ["CMD-SHELL", "clickhouse-client --password $${CLICKHOUSE_PASSWORD} --query 'SELECT 1'"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-    networks:
-      - cameleer
- 
-  cameleer-logto:
-    image: ${LOGTO_IMAGE:-gitea.siegeln.net/cameleer/cameleer-logto}:${VERSION:-latest}
-    restart: unless-stopped
-    depends_on:
-      cameleer-postgres:
-        condition: service_healthy
-    environment:
-      DB_URL: postgres://${POSTGRES_USER:-cameleer}:${POSTGRES_PASSWORD}@cameleer-postgres:5432/logto
-      ENDPOINT: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}
-      ADMIN_ENDPOINT: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}:${LOGTO_CONSOLE_PORT:-3002}
-      TRUST_PROXY_HEADER: 1
-      NODE_TLS_REJECT_UNAUTHORIZED: "${NODE_TLS_REJECT:-0}"
-      LOGTO_ENDPOINT: http://cameleer-logto:3001
-      LOGTO_ADMIN_ENDPOINT: http://cameleer-logto:3002
-      LOGTO_PUBLIC_ENDPOINT: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}
-      PUBLIC_HOST: ${PUBLIC_HOST:-localhost}
-      PUBLIC_PROTOCOL: ${PUBLIC_PROTOCOL:-https}
-      PG_HOST: cameleer-postgres
-      PG_USER: ${POSTGRES_USER:-cameleer}
-      PG_PASSWORD: ${POSTGRES_PASSWORD}
-      PG_DB_SAAS: cameleer_saas
-      SAAS_ADMIN_USER: ${SAAS_ADMIN_USER:-admin}
-      SAAS_ADMIN_PASS: ${SAAS_ADMIN_PASS:?SAAS_ADMIN_PASS must be set in .env}
-    healthcheck:
-      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3001/oidc/.well-known/openid-configuration', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))\" && test -f /data/logto-bootstrap.json"]
-      interval: 10s
-      timeout: 5s
-      retries: 60
-      start_period: 30s
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.cameleer-logto.rule=PathPrefix(`/`)
-      - traefik.http.routers.cameleer-logto.priority=1
-      - traefik.http.routers.cameleer-logto.entrypoints=websecure
-      - traefik.http.routers.cameleer-logto.tls=true
-      - traefik.http.routers.cameleer-logto.service=cameleer-logto
-      - traefik.http.routers.cameleer-logto.middlewares=cameleer-logto-cors
-      - "traefik.http.middlewares.cameleer-logto-cors.headers.accessControlAllowOriginList=${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}:${LOGTO_CONSOLE_PORT:-3002}"
-      - traefik.http.middlewares.cameleer-logto-cors.headers.accessControlAllowMethods=GET,POST,PUT,PATCH,DELETE,OPTIONS
-      - traefik.http.middlewares.cameleer-logto-cors.headers.accessControlAllowHeaders=Authorization,Content-Type
-      - traefik.http.middlewares.cameleer-logto-cors.headers.accessControlAllowCredentials=true
-      - traefik.http.services.cameleer-logto.loadbalancer.server.port=3001
-      - traefik.http.routers.cameleer-logto-console.rule=PathPrefix(`/`)
-      - traefik.http.routers.cameleer-logto-console.entrypoints=admin-console
-      - traefik.http.routers.cameleer-logto-console.tls=true
-      - traefik.http.routers.cameleer-logto-console.service=cameleer-logto-console
-      - traefik.http.services.cameleer-logto-console.loadbalancer.server.port=3002
-    volumes:
-      - cameleer-bootstrapdata:/data
-    networks:
-      - cameleer
- 
-  cameleer-saas:
-    image: ${CAMELEER_IMAGE:-gitea.siegeln.net/cameleer/cameleer-saas}:${VERSION:-latest}
-    restart: unless-stopped
-    depends_on:
-      cameleer-logto:
-        condition: service_healthy
-    environment:
-      SPRING_DATASOURCE_URL: jdbc:postgresql://cameleer-postgres:5432/cameleer_saas
-      SPRING_DATASOURCE_USERNAME: ${POSTGRES_USER:-cameleer}
-      SPRING_DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD}
-      CAMELEER_SAAS_IDENTITY_LOGTOENDPOINT: http://cameleer-logto:3001
-      CAMELEER_SAAS_IDENTITY_LOGTOPUBLICENDPOINT: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}
-      CAMELEER_SAAS_PROVISIONING_PUBLICHOST: ${PUBLIC_HOST:-localhost}
-      CAMELEER_SAAS_PROVISIONING_PUBLICPROTOCOL: ${PUBLIC_PROTOCOL:-https}
-      CAMELEER_SAAS_PROVISIONING_NETWORKNAME: ${COMPOSE_PROJECT_NAME:-cameleer-saas}_cameleer
-      CAMELEER_SAAS_PROVISIONING_TRAEFIKNETWORK: cameleer-traefik
-      CAMELEER_SAAS_PROVISIONING_DATASOURCEUSERNAME: ${POSTGRES_USER:-cameleer}
-      CAMELEER_SAAS_PROVISIONING_DATASOURCEPASSWORD: ${POSTGRES_PASSWORD}
-      CAMELEER_SAAS_PROVISIONING_CLICKHOUSEPASSWORD: ${CLICKHOUSE_PASSWORD}
-      CAMELEER_SAAS_PROVISIONING_SERVERIMAGE: ${CAMELEER_SAAS_PROVISIONING_SERVERIMAGE:-gitea.siegeln.net/cameleer/cameleer-server:latest}
-      CAMELEER_SAAS_PROVISIONING_SERVERUIIMAGE: ${CAMELEER_SAAS_PROVISIONING_SERVERUIIMAGE:-gitea.siegeln.net/cameleer/cameleer-server-ui:latest}
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.saas.rule=PathPrefix(`/platform`)
-      - traefik.http.routers.saas.entrypoints=websecure
-      - traefik.http.routers.saas.tls=true
-      - traefik.http.services.saas.loadbalancer.server.port=8080
-    volumes:
-      - cameleer-bootstrapdata:/data/bootstrap:ro
-      - cameleer-certs:/certs
-      - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
-    networks:
-      - cameleer
-    group_add:
-      - "0"
- 
-volumes:
-  cameleer-pgdata:
-  cameleer-chdata:
-  cameleer-certs:
-  cameleer-bootstrapdata:
- 
-networks:
-  cameleer:
-    driver: bridge
-  cameleer-traefik:
-    name: cameleer-traefik
-    driver: bridge
\ No newline at end of file