fix: use BOOTSTRAP_LOCAL flag to skip Host headers in bootstrap

When running inside the Logto container (BOOTSTRAP_LOCAL=true), the
bootstrap script skips Host and X-Forwarded-Proto headers on all curl
calls. This avoids issuer mismatches when Logto runs with localhost
endpoints during bootstrap mode. PUBLIC_HOST/PUBLIC_PROTOCOL remain
unchanged so redirect URIs are generated with the correct public values.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker/cameleer-logto/logto-entrypoint.sh

@@ -32,10 +32,12 @@ for i in $(seq 1 120); do
   sleep 1
 done
 
-# Run bootstrap if not already done — use localhost since we're inside the container
+# Run bootstrap — use localhost endpoints, skip Host headers (BOOTSTRAP_LOCAL flag)
+# PUBLIC_HOST and PUBLIC_PROTOCOL stay real for redirect URI generation
 BOOTSTRAP_FILE="/data/logto-bootstrap.json"
 export LOGTO_ENDPOINT="http://localhost:3001"
 export LOGTO_ADMIN_ENDPOINT="http://localhost:3002"
+export BOOTSTRAP_LOCAL="true"
 
 if [ -f "$BOOTSTRAP_FILE" ]; then
   CACHED_SECRET=$(jq -r '.m2mClientSecret // empty' "$BOOTSTRAP_FILE" 2>/dev/null)