fix: register API resource in Logto for JWT access tokens

Logto returns opaque access tokens when no resource is specified.
Added API resource creation to bootstrap, included resource indicator
in /api/config, and SPA now passes resource parameter in auth request.
Also fixed issuer-uri to match Logto's public endpoint.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/config.ts

@@ -1,6 +1,7 @@
 interface AppConfig {
   logtoEndpoint: string;
   logtoClientId: string;
+  logtoResource: string;
 }
 
 let cached: AppConfig | null = null;
@@ -22,6 +23,7 @@ export async function fetchConfig(): Promise<AppConfig> {
   cached = {
     logtoEndpoint: import.meta.env.VITE_LOGTO_ENDPOINT || 'http://localhost:3001',
     logtoClientId: import.meta.env.VITE_LOGTO_CLIENT_ID || '',
+    logtoResource: import.meta.env.VITE_LOGTO_RESOURCE || '',
   };
   return cached;
 }