feat: bootstrap 2 users, tenant, org-scoped tokens, platform admin UI

Bootstrap script now creates:
- SaaS Owner (admin/admin) with platform-admin role
- Tenant Admin (camel/camel) in Example Tenant org
- Traditional Web App for cameleer3-server OIDC
- DB records: tenant, default environment, license
- Configures cameleer3-server OIDC via its admin API
All credentials configurable via env vars.

Backend:
- Fix LogtoManagementClient resource URL (https://default.logto.app/api)
- Add getUserRoles/getUserOrganizations to LogtoManagementClient
- Add GET /api/me endpoint (user info, platform admin status, tenants)
- Add GET /api/tenants list-all for platform admins
- Remove insecure X-header forwarding from Traefik

Frontend:
- Org-scoped tokens: getAccessToken(resource, orgId) for tenant context
- OrgResolver component populates org store from /api/me
- useOrganization Zustand store (currentOrgId + currentTenantId)
- Platform admin sidebar section + AdminTenantsPage
- View Dashboard link points to cameleer3-server on port 8081

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/OrgResolver.tsx

@@ -0,0 +1,47 @@
+import { useEffect } from 'react';
+import { Spinner } from '@cameleer/design-system';
+import { useMe } from '../api/hooks';
+import { useOrgStore } from './useOrganization';
+
+/**
+ * Fetches /api/me and populates the org store with platform admin status
+ * and tenant-to-org mapping. Renders children once resolved.
+ */
+export function OrgResolver({ children }: { children: React.ReactNode }) {
+  const { data: me, isLoading, isError } = useMe();
+  const { setIsPlatformAdmin, setOrganizations, setCurrentOrg, currentOrgId } = useOrgStore();
+
+  useEffect(() => {
+    if (!me) return;
+
+    setIsPlatformAdmin(me.isPlatformAdmin);
+
+    // Map tenants: logtoOrgId is the org ID for token scoping, id is the DB UUID
+    const orgEntries = me.tenants.map((t) => ({
+      id: t.logtoOrgId,
+      name: t.name,
+      slug: t.slug,
+      tenantId: t.id,
+    }));
+    setOrganizations(orgEntries);
+
+    // Auto-select if single tenant and no org selected yet
+    if (orgEntries.length === 1 && !currentOrgId) {
+      setCurrentOrg(orgEntries[0].id);
+    }
+  }, [me]);
+
+  if (isLoading) {
+    return (
+      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', minHeight: '100vh' }}>
+        <Spinner />
+      </div>
+    );
+  }
+
+  if (isError) {
+    return null;
+  }
+
+  return <>{children}</>;
+}