feat: custom Logto sign-in UI with Cameleer branding

Replace Logto's default sign-in page with a custom React SPA that
matches the cameleer3-server login page using @cameleer/design-system.

- New Vite+React app at ui/sign-in/ with Experience API integration
- 4-step auth flow: init → verify password → identify → submit
- Design-system components: Card, Input, Button, FormField, Alert
- Same witty random subtitles as cameleer3-server LoginPage
- Dockerfile: add sign-in-frontend build stage, copy dist to image
- docker-compose: CUSTOM_UI_PATH on Logto, shared signinui volume
- SaaS entrypoint copies sign-in dist to shared volume on startup
- Add .gitattributes for LF line endings

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -9,6 +9,15 @@ RUN echo "//gitea.siegeln.net/api/packages/cameleer/npm/:_authToken=${REGISTRY_T
 COPY ui/ .
 RUN npm run build
 
+# Sign-in UI: custom Logto sign-in experience
+FROM --platform=$BUILDPLATFORM node:22-alpine AS sign-in-frontend
+ARG REGISTRY_TOKEN
+WORKDIR /ui
+COPY ui/sign-in/package.json ui/sign-in/package-lock.json ui/sign-in/.npmrc ./
+RUN echo "//gitea.siegeln.net/api/packages/cameleer/npm/:_authToken=${REGISTRY_TOKEN}" >> .npmrc && npm ci
+COPY ui/sign-in/ .
+RUN npm run build
+
 # Maven build: runs natively on build host (no QEMU emulation)
 FROM --platform=$BUILDPLATFORM eclipse-temurin:21-jdk-alpine AS build
 WORKDIR /build
@@ -25,6 +34,9 @@ FROM eclipse-temurin:21-jre-alpine
 WORKDIR /app
 RUN addgroup -S cameleer && adduser -S cameleer -G cameleer
 COPY --from=build /build/target/*.jar app.jar
+COPY --from=sign-in-frontend /ui/dist/ /app/sign-in-dist/
+COPY docker/saas-entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
 USER cameleer
 EXPOSE 8080
-ENTRYPOINT ["java", "-jar", "app.jar"]
+ENTRYPOINT ["/app/entrypoint.sh"]