feat: bootstrap 2 users, tenant, org-scoped tokens, platform admin UI

Bootstrap script now creates:
- SaaS Owner (admin/admin) with platform-admin role
- Tenant Admin (camel/camel) in Example Tenant org
- Traditional Web App for cameleer3-server OIDC
- DB records: tenant, default environment, license
- Configures cameleer3-server OIDC via its admin API
All credentials configurable via env vars.

Backend:
- Fix LogtoManagementClient resource URL (https://default.logto.app/api)
- Add getUserRoles/getUserOrganizations to LogtoManagementClient
- Add GET /api/me endpoint (user info, platform admin status, tenants)
- Add GET /api/tenants list-all for platform admins
- Remove insecure X-header forwarding from Traefik

Frontend:
- Org-scoped tokens: getAccessToken(resource, orgId) for tenant context
- OrgResolver component populates org store from /api/me
- useOrganization Zustand store (currentOrgId + currentTenantId)
- Platform admin sidebar section + AdminTenantsPage
- View Dashboard link points to cameleer3-server on port 8081

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/router.tsx

@@ -2,12 +2,14 @@ import { Routes, Route } from 'react-router';
 import { LoginPage } from './auth/LoginPage';
 import { CallbackPage } from './auth/CallbackPage';
 import { ProtectedRoute } from './auth/ProtectedRoute';
+import { OrgResolver } from './auth/OrgResolver';
 import { Layout } from './components/Layout';
 import { DashboardPage } from './pages/DashboardPage';
 import { EnvironmentsPage } from './pages/EnvironmentsPage';
 import { EnvironmentDetailPage } from './pages/EnvironmentDetailPage';
 import { AppDetailPage } from './pages/AppDetailPage';
 import { LicensePage } from './pages/LicensePage';
+import { AdminTenantsPage } from './pages/AdminTenantsPage';
 
 export function AppRouter() {
   return (
@@ -17,7 +19,9 @@ export function AppRouter() {
       <Route
         element={
           <ProtectedRoute>
-            <Layout />
+            <OrgResolver>
+              <Layout />
+            </OrgResolver>
           </ProtectedRoute>
         }
       >
@@ -26,6 +30,7 @@ export function AppRouter() {
         <Route path="environments/:envId" element={<EnvironmentDetailPage />} />
         <Route path="environments/:envId/apps/:appId" element={<AppDetailPage />} />
         <Route path="license" element={<LicensePage />} />
+        <Route path="admin/tenants" element={<AdminTenantsPage />} />
       </Route>
     </Routes>
   );