feat: bootstrap 2 users, tenant, org-scoped tokens, platform admin UI

Bootstrap script now creates:
- SaaS Owner (admin/admin) with platform-admin role
- Tenant Admin (camel/camel) in Example Tenant org
- Traditional Web App for cameleer3-server OIDC
- DB records: tenant, default environment, license
- Configures cameleer3-server OIDC via its admin API
All credentials configurable via env vars.

Backend:
- Fix LogtoManagementClient resource URL (https://default.logto.app/api)
- Add getUserRoles/getUserOrganizations to LogtoManagementClient
- Add GET /api/me endpoint (user info, platform admin status, tenants)
- Add GET /api/tenants list-all for platform admins
- Remove insecure X-header forwarding from Traefik

Frontend:
- Org-scoped tokens: getAccessToken(resource, orgId) for tenant context
- OrgResolver component populates org store from /api/me
- useOrganization Zustand store (currentOrgId + currentTenantId)
- Platform admin sidebar section + AdminTenantsPage
- View Dashboard link points to cameleer3-server on port 8081

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/api/hooks.ts

@@ -3,7 +3,7 @@ import { api } from './client';
 import type {
   TenantResponse, EnvironmentResponse, AppResponse,
   DeploymentResponse, LicenseResponse, AgentStatusResponse,
-  ObservabilityStatusResponse, LogEntry,
+  ObservabilityStatusResponse, LogEntry, MeResponse,
 } from '../types/api';
 
 // Tenant
@@ -183,3 +183,19 @@ export function useLogs(appId: string, params?: { since?: string; limit?: number
     enabled: !!appId,
   });
 }
+
+// Platform
+export function useMe() {
+  return useQuery({
+    queryKey: ['me'],
+    queryFn: () => api.get<MeResponse>('/me'),
+    staleTime: 60_000,
+  });
+}
+
+export function useAllTenants() {
+  return useQuery({
+    queryKey: ['tenants', 'all'],
+    queryFn: () => api.get<TenantResponse[]>('/tenants'),
+  });
+}