fix: mount custom sign-in UI over Logto experience dist

CUSTOM_UI_PATH is a Logto Cloud feature, not available in OSS.
The correct approach for self-hosted Logto is to volume-mount
over /etc/logto/packages/experience/dist/.

- Use init container (sign-in-ui) to copy dist to shared volume
  as root (fixes permission denied with cameleer user)
- Logto mounts signinui volume at experience/dist path
- Logto depends on sign-in-ui init container completion
- Remove saas-entrypoint.sh approach (no longer needed)
- Revert Dockerfile entrypoint to direct java -jar
- Permit /favicon.svg in SecurityConfig for sign-in page logo

Tested: full OIDC flow works end-to-end via Playwright.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -35,8 +35,6 @@ WORKDIR /app
 RUN addgroup -S cameleer && adduser -S cameleer -G cameleer
 COPY --from=build /build/target/*.jar app.jar
 COPY --from=sign-in-frontend /ui/dist/ /app/sign-in-dist/
-COPY docker/saas-entrypoint.sh /app/entrypoint.sh
-RUN chmod +x /app/entrypoint.sh
 USER cameleer
 EXPOSE 8080
-ENTRYPOINT ["/app/entrypoint.sh"]
+ENTRYPOINT ["java", "-jar", "app.jar"]