fix: route all public traffic through Traefik at localhost:80

Logto ENDPOINT now points at Traefik (http://localhost) instead of
directly at port 3001. All services share the same base URL, eliminating
OIDC issuer mismatches and crypto.subtle secure context issues.

- Remove :3001 from all public-facing Logto URLs
- Add cameleer3-server-ui to Traefik at /server/ with prefix strip
- Dashboard link uses /server/ path instead of port 8082
- Bootstrap Host headers match Logto ENDPOINT (no port)
- Redirect URIs simplified (Traefik handles port 80)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -39,7 +39,7 @@ services:
     entrypoint: ["sh", "-c", "npm run cli db seed -- --swe && npm start"]
     environment:
       DB_URL: postgres://${POSTGRES_USER:-cameleer}:${POSTGRES_PASSWORD:-cameleer_dev}@postgres:5432/logto
-      ENDPOINT: http://${PUBLIC_HOST:-localhost}:3001
+      ENDPOINT: http://${PUBLIC_HOST:-localhost}
       ADMIN_ENDPOINT: http://${PUBLIC_HOST:-localhost}:3002
       TRUST_PROXY_HEADER: 1
     healthcheck:
@@ -67,7 +67,7 @@ services:
     environment:
       LOGTO_ENDPOINT: http://logto:3001
       LOGTO_ADMIN_ENDPOINT: http://logto:3002
-      LOGTO_PUBLIC_ENDPOINT: http://${PUBLIC_HOST:-localhost}:3001
+      LOGTO_PUBLIC_ENDPOINT: http://${PUBLIC_HOST:-localhost}
       PUBLIC_HOST: ${PUBLIC_HOST:-localhost}
       PG_HOST: postgres
       PG_USER: ${POSTGRES_USER:-cameleer}
@@ -104,8 +104,8 @@ services:
       SPRING_DATASOURCE_USERNAME: ${POSTGRES_USER:-cameleer}
       SPRING_DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD:-cameleer_dev}
       LOGTO_ENDPOINT: ${LOGTO_ENDPOINT:-http://logto:3001}
-      LOGTO_PUBLIC_ENDPOINT: http://${PUBLIC_HOST:-localhost}:3001
-      LOGTO_ISSUER_URI: http://${PUBLIC_HOST:-localhost}:3001/oidc
+      LOGTO_PUBLIC_ENDPOINT: http://${PUBLIC_HOST:-localhost}
+      LOGTO_ISSUER_URI: http://${PUBLIC_HOST:-localhost}/oidc
       LOGTO_JWK_SET_URI: ${LOGTO_ENDPOINT:-http://logto:3001}/oidc/jwks
       LOGTO_M2M_CLIENT_ID: ${LOGTO_M2M_CLIENT_ID:-}
       LOGTO_M2M_CLIENT_SECRET: ${LOGTO_M2M_CLIENT_SECRET:-}
@@ -139,7 +139,7 @@ services:
       CAMELEER_AUTH_TOKEN: ${CAMELEER_AUTH_TOKEN:-default-bootstrap-token}
       CAMELEER_JWT_SECRET: ${CAMELEER_JWT_SECRET:-cameleer-dev-jwt-secret-change-in-production}
       CAMELEER_TENANT_ID: ${CAMELEER_TENANT_SLUG:-default}
-      CAMELEER_OIDC_ISSUER_URI: http://${PUBLIC_HOST:-localhost}:3001/oidc
+      CAMELEER_OIDC_ISSUER_URI: http://${PUBLIC_HOST:-localhost}/oidc
       CAMELEER_OIDC_AUDIENCE: ${CAMELEER_OIDC_AUDIENCE:-https://api.cameleer.local}
     healthcheck:
       test: ["CMD-SHELL", "curl -sf http://localhost:8081/api/v1/health || exit 1"]
@@ -168,6 +168,13 @@ services:
         condition: service_healthy
     environment:
       CAMELEER_API_URL: http://cameleer3-server:8081
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.server-ui.rule=PathPrefix(`/server`)
+      - traefik.http.routers.server-ui.service=server-ui
+      - traefik.http.routers.server-ui.middlewares=server-ui-strip
+      - traefik.http.middlewares.server-ui-strip.stripprefix.prefixes=/server
+      - traefik.http.services.server-ui.loadbalancer.server.port=80
     networks:
       - cameleer