fix: use separate CH credentials, remove dead bootstrap code

- ClickHouse: pass user/password via ProvisioningProperties instead of
  baking into JDBC URLs. All consumers (InfrastructureService,
  TenantDataCleanupService, DockerTenantProvisioner) use the same source.
- Bootstrap: remove dead tenant config (CAMELEER_AUTH_TOKEN, t-default
  org, example tenant vars) — tenants are created dynamically by vendor.
- Bootstrap JSON: remove unused fields (tenantName, tenantSlug,
  bootstrapToken, tenantAdminUser, organizationId).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/main/java/net/siegeln/cameleer/saas/provisioning/DockerTenantProvisioner.java

@@ -195,7 +195,9 @@ public class DockerTenantProvisioner implements TenantProvisioner {
             "SPRING_DATASOURCE_URL=" + props.datasourceUrl(),
             "SPRING_DATASOURCE_USERNAME=cameleer",
             "SPRING_DATASOURCE_PASSWORD=cameleer_dev",
-            "CAMELEER_SERVER_CLICKHOUSE_URL=jdbc:clickhouse://clickhouse:8123/cameleer?user=default&password=cameleer_ch",
+            "CAMELEER_SERVER_CLICKHOUSE_URL=jdbc:clickhouse://clickhouse:8123/cameleer",
+            "CAMELEER_SERVER_CLICKHOUSE_USERNAME=" + props.clickhouseUser(),
+            "CAMELEER_SERVER_CLICKHOUSE_PASSWORD=" + props.clickhousePassword(),
             "CAMELEER_SERVER_TENANT_ID=" + slug,
             "CAMELEER_SERVER_SECURITY_BOOTSTRAPTOKEN=" + req.licenseToken(),
             "CAMELEER_SERVER_SECURITY_JWTSECRET=cameleer-dev-jwt-secret-change-in-production",

src/main/java/net/siegeln/cameleer/saas/provisioning/ProvisioningProperties.java

@@ -12,6 +12,8 @@ public record ProvisioningProperties(
     String publicProtocol,
     String datasourceUrl,
     String clickhouseUrl,
+    String clickhouseUser,
+    String clickhousePassword,
     String oidcIssuerUri,
     String oidcJwkSetUri,
     String corsOrigins

src/main/java/net/siegeln/cameleer/saas/provisioning/TenantDataCleanupService.java

@@ -60,7 +60,7 @@ public class TenantDataCleanupService {
             return;
         }
 
-        try (Connection conn = DriverManager.getConnection(url);
+        try (Connection conn = DriverManager.getConnection(url, props.clickhouseUser(), props.clickhousePassword());
              Statement stmt = conn.createStatement()) {
 
             // Find all tables with a tenant_id column

src/main/java/net/siegeln/cameleer/saas/vendor/InfrastructureService.java

@@ -275,6 +275,6 @@ public class InfrastructureService {
     }
 
     private Connection chConnection() throws SQLException {
-        return DriverManager.getConnection(props.clickhouseUrl());
+        return DriverManager.getConnection(props.clickhouseUrl(), props.clickhouseUser(), props.clickhousePassword());
     }
 }

src/main/resources/application-local.yml

@@ -22,4 +22,4 @@ cameleer:
       logtoendpoint: http://localhost:3001
       serverendpoint: http://localhost:8081
     provisioning:
-      clickhouseurl: jdbc:clickhouse://localhost:8123/cameleer?user=default&password=cameleer_ch
+      clickhouseurl: jdbc:clickhouse://localhost:8123/cameleer

src/main/resources/application.yml

@@ -50,7 +50,9 @@ cameleer:
       publichost: ${CAMELEER_SAAS_PROVISIONING_PUBLICHOST:localhost}
       publicprotocol: ${CAMELEER_SAAS_PROVISIONING_PUBLICPROTOCOL:https}
       datasourceurl: ${CAMELEER_SAAS_PROVISIONING_DATASOURCEURL:jdbc:postgresql://postgres:5432/cameleer3}
-      clickhouseurl: ${CAMELEER_SAAS_PROVISIONING_CLICKHOUSEURL:jdbc:clickhouse://clickhouse:8123/cameleer?user=default&password=cameleer_ch}
+      clickhouseurl: ${CAMELEER_SAAS_PROVISIONING_CLICKHOUSEURL:jdbc:clickhouse://clickhouse:8123/cameleer}
+      clickhouseuser: ${CAMELEER_SAAS_PROVISIONING_CLICKHOUSEUSER:default}
+      clickhousepassword: ${CAMELEER_SAAS_PROVISIONING_CLICKHOUSEPASSWORD:${CLICKHOUSE_PASSWORD:cameleer_ch}}
       oidcissueruri: ${cameleer.saas.provisioning.publicprotocol}://${cameleer.saas.provisioning.publichost}/oidc
       oidcjwkseturi: http://logto:3001/oidc/jwks
       corsorigins: ${cameleer.saas.provisioning.publicprotocol}://${cameleer.saas.provisioning.publichost}