fix: register API resource in Logto for JWT access tokens

Logto returns opaque access tokens when no resource is specified.
Added API resource creation to bootstrap, included resource indicator
in /api/config, and SPA now passes resource parameter in auth request.
Also fixed issuer-uri to match Logto's public endpoint.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/LoginPage.tsx

@@ -4,7 +4,7 @@ import { fetchConfig } from '../config';
 import { generatePkce, storeCodeVerifier } from './pkce';
 
 export function LoginPage() {
-  const [config, setConfig] = useState<{ logtoEndpoint: string; logtoClientId: string } | null>(null);
+  const [config, setConfig] = useState<{ logtoEndpoint: string; logtoClientId: string; logtoResource: string } | null>(null);
   const [loading, setLoading] = useState(true);
 
   useEffect(() => {
@@ -35,6 +35,9 @@ export function LoginPage() {
       code_challenge: codeChallenge,
       code_challenge_method: 'S256',
     });
+    if (config.logtoResource) {
+      params.set('resource', config.logtoResource);
+    }
     window.location.href = `${config.logtoEndpoint}/oidc/auth?${params}`;
   };