fix: security hardening — remove dead routes, add JWT audience validation

- Remove broken observe/dashboard Traefik routes (server accessed via /server only)
- Remove unused acme volume
- Add JWT audience claim validation (https://api.cameleer.local) in SecurityConfig
- Secure bootstrap output file with chmod 600
- Add dev-only comments on TLS_SKIP_VERIFY and credential logging

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -34,7 +34,6 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./traefik.yml:/etc/traefik/traefik.yml:ro
       - ./docker/traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
-      - acme:/etc/traefik/acme
       - certs:/etc/traefik/certs:ro
     networks:
       - cameleer
@@ -169,7 +168,7 @@ services:
       CAMELEER_TENANT_ID: ${CAMELEER_TENANT_SLUG:-default}
       CAMELEER_OIDC_ISSUER_URI: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}/oidc
       CAMELEER_OIDC_JWK_SET_URI: ${LOGTO_ENDPOINT:-http://logto:3001}/oidc/jwks
-      CAMELEER_OIDC_TLS_SKIP_VERIFY: "true"
+      CAMELEER_OIDC_TLS_SKIP_VERIFY: "true"  # dev only — disable in production with real certs
       CAMELEER_OIDC_AUDIENCE: ${CAMELEER_OIDC_AUDIENCE:-https://api.cameleer.local}
       CAMELEER_CORS_ALLOWED_ORIGINS: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}
     healthcheck:
@@ -179,15 +178,7 @@ services:
       retries: 30
       start_period: 15s
     labels:
-      - traefik.enable=true
-      - traefik.http.routers.observe.rule=PathPrefix(`/observe`)
-      - traefik.http.routers.observe.service=observe
-      - traefik.http.services.observe.loadbalancer.server.port=8080
-      - traefik.http.routers.dashboard.rule=PathPrefix(`/dashboard`)
-      - traefik.http.routers.dashboard.service=dashboard
-      - traefik.http.routers.dashboard.middlewares=dashboard-strip
-      - traefik.http.middlewares.dashboard-strip.stripprefix.prefixes=/dashboard
-      - traefik.http.services.dashboard.loadbalancer.server.port=8080
+      - traefik.enable=false
     networks:
       - cameleer
 
@@ -234,7 +225,6 @@ networks:
 volumes:
   pgdata:
   chdata:
-  acme:
   certs:
   jardata:
   bootstrapdata: