fix: route all public traffic through Traefik at localhost:80

Logto ENDPOINT now points at Traefik (http://localhost) instead of
directly at port 3001. All services share the same base URL, eliminating
OIDC issuer mismatches and crypto.subtle secure context issues.

- Remove :3001 from all public-facing Logto URLs
- Add cameleer3-server-ui to Traefik at /server/ with prefix strip
- Dashboard link uses /server/ path instead of port 8082
- Bootstrap Host headers match Logto ENDPOINT (no port)
- Redirect URIs simplified (Traefik handles port 80)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/components/Layout.tsx

@@ -162,7 +162,7 @@ export function Layout() {
         <Sidebar.FooterLink
           icon={<ObsIcon />}
           label="View Dashboard"
-          onClick={() => window.open(`http://${window.location.hostname}:8082`, '_blank', 'noopener')}
+          onClick={() => window.open('/server/', '_blank', 'noopener')}
         />
 
         {/* User info + logout */}

ui/src/config.ts

@@ -22,7 +22,7 @@ export async function fetchConfig(): Promise<AppConfig> {
 
   // Fallback to env vars (Vite dev mode)
   cached = {
-    logtoEndpoint: import.meta.env.VITE_LOGTO_ENDPOINT || `http://${window.location.hostname}:3001`,
+    logtoEndpoint: import.meta.env.VITE_LOGTO_ENDPOINT || `http://${window.location.hostname}`,
     logtoClientId: import.meta.env.VITE_LOGTO_CLIENT_ID || '',
     logtoResource: import.meta.env.VITE_LOGTO_RESOURCE || '',
     scopes: [