fix(auth): upsert UI login user_id unprefixed (drop docker seeder workaround)

Root cause of the mismatch that prompted the one-shot cameleer-seed
docker service: UiAuthController stored users.user_id as the JWT
subject "user:admin" (JWT sub format). Every env-scoped controller
(Alert, AlertSilence, AlertRule, OutboundConnectionAdmin) already
strips the "user:" prefix on the read path — so the rest of the
system expects the DB key to be the bare username. With UiAuth
storing prefixed, fresh docker stacks hit
"alert_rules_created_by_fkey violation" on the first rule create.

Fix: inside login(), compute `userId = request.username()` and use
it everywhere the DB/RBAC layer is touched (isLocked, getPasswordHash,
record/clearFailedLogins, upsert, assignRoleToUser, addUserToGroup,
getSystemRoleNames). Keep `subject = "user:" + userId` — we still
sign JWTs with the namespaced subject so JwtAuthenticationFilter can
distinguish user vs agent tokens.

refresh() and me() follow the same rule via a stripSubjectPrefix()
helper (JWT subject in, bare DB key out).

With the write path aligned, the docker bridge is no longer needed:
- Deleted deploy/docker/postgres-init.sql
- Deleted cameleer-seed service from docker-compose.yml

Scope: UiAuthController only. UserAdminController + OidcAuthController
still prefix on upsert — that's the bug class the triage identified
as "Option A or B either way OK". Not changing them now because:
  a) prod admins are provisioned unprefixed through some other path,
     so those two files aren't the docker-only failure observed;
  b) stripping them would need a data migration for any existing
     prod users stored prefixed, which is out of scope for a cleanup
     phase. Follow-up worth scheduling if we ever wire OIDC or admin-
     created users into alerting FKs.

Verified: 33/33 alerting+outbound controller ITs pass (9 outbound,
10 rules, 9 silences, 5 alert inbox).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -130,25 +130,6 @@ services:
       retries: 10
     restart: unless-stopped
 
-  # Run-once seeder: waits for the server to be healthy (i.e. Flyway migrations
-  # finished) and inserts a `user_id='admin'` row (without the `user:` prefix)
-  # so alerting-controller FKs succeed. See deploy/docker/postgres-init.sql for
-  # the full rationale. Idempotent — exits 0 if the row already exists.
-  cameleer-seed:
-    image: postgres:16
-    container_name: cameleer-seed
-    depends_on:
-      cameleer-server:
-        condition: service_healthy
-    environment:
-      PGPASSWORD: cameleer_dev
-    volumes:
-      - ./deploy/docker/postgres-init.sql:/seed.sql:ro
-    entrypoint: ["sh", "-c"]
-    command:
-      - "psql -h cameleer-postgres -U cameleer -d cameleer -v ON_ERROR_STOP=1 -f /seed.sql"
-    restart: "no"
-
 volumes:
   cameleer-pgdata:
   cameleer-chdata: