feat: merge bootstrap into cameleer-logto image

Adds logto-entrypoint.sh that seeds DB, starts Logto, waits for health,
runs bootstrap, then keeps Logto running. Eliminates the separate
logto-bootstrap init container.

ui/sign-in/Dockerfile

@@ -1,12 +1,28 @@
 # syntax=docker/dockerfile:1
 
+# Stage 1: Build custom sign-in UI
 FROM --platform=$BUILDPLATFORM node:22-alpine AS build
 ARG REGISTRY_TOKEN
 WORKDIR /ui
-COPY package.json package-lock.json .npmrc ./
+COPY ui/sign-in/package.json ui/sign-in/package-lock.json ui/sign-in/.npmrc ./
 RUN --mount=type=cache,target=/root/.npm echo "//gitea.siegeln.net/api/packages/cameleer/npm/:_authToken=${REGISTRY_TOKEN}" >> .npmrc && npm ci
-COPY . .
+COPY ui/sign-in/ .
 RUN npm run build
 
+# Stage 2: Logto with sign-in UI + bootstrap
 FROM ghcr.io/logto-io/logto:latest
+
+# Install bootstrap dependencies (curl, jq for API calls; postgresql-client for DB reads)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl jq postgresql-client \
+    && rm -rf /var/lib/apt/lists/*
+
+# Custom sign-in UI
 COPY --from=build /ui/dist/ /etc/logto/packages/experience/dist/
+
+# Bootstrap scripts
+COPY docker/logto-bootstrap.sh /scripts/logto-bootstrap.sh
+COPY docker/cameleer-logto/logto-entrypoint.sh /scripts/entrypoint.sh
+RUN chmod +x /scripts/*.sh
+
+ENTRYPOINT ["/scripts/entrypoint.sh"]