Add moat-strengthening features design spec

Comprehensive design document for three defensibility features:
- Live Route Debugger (replay-based, zero production impact)
- Payload Flow Lineage (targeted per-processor capture + diff)
- Cross-Service Trace Correlation + Topology Map (network effect)

Gitea issues: cameleer/cameleer3 #57-#72 (MOAT label)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -0,0 +1,39 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project
+
+Cameleer SaaS — multi-tenant SaaS platform wrapping the Cameleer observability stack (Java agent + server) for Apache Camel applications. Customers get managed observability for their Camel integrations without running infrastructure.
+
+## Ecosystem
+
+This repo is the SaaS layer on top of two proven components:
+
+- **cameleer3** (sibling repo) — Java agent using ByteBuddy for zero-code instrumentation of Camel apps. Captures route executions, processor traces, payloads, metrics, and route graph topology. Deploys as `-javaagent` JAR.
+- **cameleer3-server** (sibling repo) — Spring Boot observability backend. Receives agent data via HTTP, pushes config/commands via SSE. PostgreSQL + OpenSearch storage. React SPA dashboard. JWT auth with Ed25519 config signing.
+- **cameleer-website** — Marketing site (Astro 5)
+- **design-system** — Shared React component library (`@cameleer/design-system` on Gitea npm registry)
+
+Agent-server protocol is defined in `cameleer3/cameleer3-common/PROTOCOL.md`. The agent and server are mature, proven components — this repo wraps them with multi-tenancy, billing, and self-service onboarding.
+
+## Architecture Context
+
+The existing cameleer3-server already has single-tenant auth (JWT, RBAC, bootstrap tokens, OIDC). The SaaS layer must:
+- Add multi-tenancy (tenant isolation of agent data, diagrams, configs)
+- Provide self-service signup, billing, and team management
+- Generate per-tenant bootstrap tokens for agent registration
+- Proxy or federate access to tenant-specific cameleer3-server instances
+- Enforce usage quotas and metered billing
+
+## Related Conventions
+
+- Gitea-hosted: `gitea.siegeln.net/cameleer/`
+- CI: `.gitea/workflows/` — Gitea Actions
+- K8s target: k3s cluster at 192.168.50.86
+- Docker builds: multi-stage, buildx with registry cache, `--provenance=false` for Gitea compatibility
+- Design system: import from `@cameleer/design-system` (Gitea npm registry)
+
+## Disabled Skills
+
+- Do NOT use any `gsd:*` skills in this project. This includes all `/gsd:` prefixed commands.