feat: add deployment mode — vendor (multi-tenant) or single-tenant

Installer now asks deployment mode in simple mode:
- Multi-tenant vendor: creates saas-vendor role + assigns to admin
- Single tenant: asks for org name, creates Logto org + tenant record,
  assigns admin as org owner

Reverts always-create-vendor-role — role is only created when vendor
mode is selected. TENANT_ORG_NAME env var passed to bootstrap for
single-tenant org creation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

installer/install.sh

@@ -72,6 +72,7 @@ VERSION=""
 COMPOSE_PROJECT=""
 DOCKER_SOCKET=""
 NODE_TLS_REJECT=""
+TENANT_ORG_NAME=""
 
 # --- State ---
 MODE=""  # simple, expert, silent
@@ -174,6 +175,7 @@ parse_args() {
       --compose-project)  COMPOSE_PROJECT="$2"; shift ;;
       --docker-socket)    DOCKER_SOCKET="$2"; shift ;;
       --node-tls-reject)  NODE_TLS_REJECT="$2"; shift ;;
+      --tenant-org-name)  TENANT_ORG_NAME="$2"; shift ;;
       --reconfigure)      RERUN_ACTION="reconfigure" ;;
       --reinstall)        RERUN_ACTION="reinstall" ;;
       --confirm-destroy)  CONFIRM_DESTROY=true ;;
@@ -258,6 +260,7 @@ load_config_file() {
       compose_project)      [ -z "$COMPOSE_PROJECT" ] && COMPOSE_PROJECT="$value" ;;
       docker_socket)        [ -z "$DOCKER_SOCKET" ] && DOCKER_SOCKET="$value" ;;
       node_tls_reject)      [ -z "$NODE_TLS_REJECT" ] && NODE_TLS_REJECT="$value" ;;
+      tenant_org_name)    [ -z "$TENANT_ORG_NAME" ] && TENANT_ORG_NAME="$value" ;;
     esac
   done < "$file"
 }
@@ -424,6 +427,24 @@ run_simple_prompts() {
 
   echo ""
   prompt MONITORING_NETWORK "Monitoring network name (empty = skip)" ""
+
+  echo ""
+  echo "  Deployment mode:"
+  echo "    [1] Multi-tenant vendor — admin manages platform, creates tenants on demand"
+  echo "    [2] Single tenant — set up one tenant for immediate use"
+  echo ""
+  local deploy_choice
+  read -rp "  Select mode [1]: " deploy_choice
+  case "${deploy_choice:-1}" in
+    2)
+      VENDOR_ENABLED="false"
+      prompt TENANT_ORG_NAME "Organization / tenant name" ""
+      ;;
+    *)
+      VENDOR_ENABLED="true"
+      TENANT_ORG_NAME=""
+      ;;
+  esac
 }
 
 run_expert_prompts() {
@@ -623,6 +644,9 @@ VENDOR_SEED_ENABLED=${VENDOR_ENABLED}
 VENDOR_USER=${VENDOR_USER}
 VENDOR_PASS=${VENDOR_PASS:-}
 
+# Single-tenant org (when vendor is disabled)
+TENANT_ORG_NAME=${TENANT_ORG_NAME:-}
+
 # Docker
 DOCKER_SOCKET=${DOCKER_SOCKET}
 
@@ -771,6 +795,7 @@ EOF
       VENDOR_SEED_ENABLED: "${VENDOR_SEED_ENABLED:-false}"
       VENDOR_USER: ${VENDOR_USER:-vendor}
       VENDOR_PASS: ${VENDOR_PASS:-vendor}
+      TENANT_ORG_NAME: ${TENANT_ORG_NAME:-}
     healthcheck:
       test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3001/oidc/.well-known/openid-configuration', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))\" && test -f /data/logto-bootstrap.json"]
       interval: 10s
@@ -985,6 +1010,7 @@ version=${VERSION}
 compose_project=${COMPOSE_PROJECT}
 docker_socket=${DOCKER_SOCKET}
 node_tls_reject=${NODE_TLS_REJECT}
+tenant_org_name=${TENANT_ORG_NAME}
 EOF
   log_info "Saved installer config to cameleer.conf"
 }