feat: bootstrap 2 users, tenant, org-scoped tokens, platform admin UI

Bootstrap script now creates:
- SaaS Owner (admin/admin) with platform-admin role
- Tenant Admin (camel/camel) in Example Tenant org
- Traditional Web App for cameleer3-server OIDC
- DB records: tenant, default environment, license
- Configures cameleer3-server OIDC via its admin API
All credentials configurable via env vars.

Backend:
- Fix LogtoManagementClient resource URL (https://default.logto.app/api)
- Add getUserRoles/getUserOrganizations to LogtoManagementClient
- Add GET /api/me endpoint (user info, platform admin status, tenants)
- Add GET /api/tenants list-all for platform admins
- Remove insecure X-header forwarding from Traefik

Frontend:
- Org-scoped tokens: getAccessToken(resource, orgId) for tenant context
- OrgResolver component populates org store from /api/me
- useOrganization Zustand store (currentOrgId + currentTenantId)
- Platform admin sidebar section + AdminTenantsPage
- View Dashboard link points to cameleer3-server on port 8081

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/useAuth.ts

@@ -1,5 +1,6 @@
 import { useLogto } from '@logto/react';
 import { useState, useEffect, useCallback } from 'react';
+import { useOrgStore } from './useOrganization';
 
 interface IdTokenClaims {
   sub?: string;
@@ -14,6 +15,7 @@ interface IdTokenClaims {
 export function useAuth() {
   const { isAuthenticated, isLoading, getIdTokenClaims, signOut, signIn } = useLogto();
   const [claims, setClaims] = useState<IdTokenClaims | null>(null);
+  const { currentTenantId, isPlatformAdmin } = useOrgStore();
 
   useEffect(() => {
     if (isAuthenticated) {
@@ -25,7 +27,8 @@ export function useAuth() {
 
   const username = claims?.username ?? claims?.name ?? claims?.email ?? claims?.sub ?? null;
   const roles = (claims?.roles as string[]) ?? [];
-  const tenantId = (claims?.organization_id as string) ?? null;
+  // tenantId is the DB UUID from the org store (set by OrgResolver after /api/me)
+  const tenantId = currentTenantId;
 
   const logout = useCallback(() => {
     signOut(window.location.origin + '/login');
@@ -37,6 +40,7 @@ export function useAuth() {
     username,
     roles,
     tenantId,
+    isPlatformAdmin,
     logout,
     signIn,
   };