feat: bootstrap 2 users, tenant, org-scoped tokens, platform admin UI

Bootstrap script now creates:
- SaaS Owner (admin/admin) with platform-admin role
- Tenant Admin (camel/camel) in Example Tenant org
- Traditional Web App for cameleer3-server OIDC
- DB records: tenant, default environment, license
- Configures cameleer3-server OIDC via its admin API
All credentials configurable via env vars.

Backend:
- Fix LogtoManagementClient resource URL (https://default.logto.app/api)
- Add getUserRoles/getUserOrganizations to LogtoManagementClient
- Add GET /api/me endpoint (user info, platform admin status, tenants)
- Add GET /api/tenants list-all for platform admins
- Remove insecure X-header forwarding from Traefik

Frontend:
- Org-scoped tokens: getAccessToken(resource, orgId) for tenant context
- OrgResolver component populates org store from /api/me
- useOrganization Zustand store (currentOrgId + currentTenantId)
- Platform admin sidebar section + AdminTenantsPage
- View Dashboard link points to cameleer3-server on port 8081

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -60,14 +60,26 @@ services:
     depends_on:
       logto:
         condition: service_healthy
+      cameleer3-server:
+        condition: service_healthy
     restart: "no"
     entrypoint: ["sh", "/scripts/logto-bootstrap.sh"]
     environment:
       LOGTO_ENDPOINT: http://logto:3001
       LOGTO_ADMIN_ENDPOINT: http://logto:3002
+      LOGTO_PUBLIC_ENDPOINT: ${LOGTO_PUBLIC_ENDPOINT:-http://localhost:3001}
       PG_HOST: postgres
       PG_USER: ${POSTGRES_USER:-cameleer}
       PG_PASSWORD: ${POSTGRES_PASSWORD:-cameleer_dev}
+      PG_DB_SAAS: ${POSTGRES_DB:-cameleer_saas}
+      SAAS_ADMIN_USER: ${SAAS_ADMIN_USER:-admin}
+      SAAS_ADMIN_PASS: ${SAAS_ADMIN_PASS:-admin}
+      TENANT_ADMIN_USER: ${TENANT_ADMIN_USER:-camel}
+      TENANT_ADMIN_PASS: ${TENANT_ADMIN_PASS:-camel}
+      CAMELEER_AUTH_TOKEN: ${CAMELEER_AUTH_TOKEN:-default-bootstrap-token}
+      SERVER_ENDPOINT: http://cameleer3-server:8081
+      SERVER_UI_USER: ${CAMELEER_UI_USER:-admin}
+      SERVER_UI_PASS: ${CAMELEER_UI_PASSWORD:-admin}
     volumes:
       - ./docker/logto-bootstrap.sh:/scripts/logto-bootstrap.sh:ro
       - bootstrapdata:/data
@@ -133,13 +145,18 @@ services:
       CAMELEER_AUTH_TOKEN: ${CAMELEER_AUTH_TOKEN:-default-bootstrap-token}
       CAMELEER_JWT_SECRET: ${CAMELEER_JWT_SECRET:-cameleer-dev-jwt-secret-change-in-production}
       CAMELEER_TENANT_ID: ${CAMELEER_TENANT_SLUG:-default}
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:8081/api/v1/health || exit 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+      start_period: 15s
     labels:
       - traefik.enable=true
       - traefik.http.routers.observe.rule=PathPrefix(`/observe`)
       - traefik.http.routers.observe.service=observe
       - traefik.http.routers.observe.middlewares=forward-auth
       - traefik.http.middlewares.forward-auth.forwardauth.address=http://cameleer-saas:8080/auth/verify
-      - traefik.http.middlewares.forward-auth.forwardauth.authResponseHeaders=X-Tenant-Id,X-User-Id,X-User-Email
       - traefik.http.services.observe.loadbalancer.server.port=8080
       - traefik.http.routers.dashboard.rule=PathPrefix(`/dashboard`)
       - traefik.http.routers.dashboard.service=dashboard