docs: scrub siegeln.net and LAN IPs from customer-facing docs

Replace personal-infra references with brand-aligned placeholders so
the public-facing setup docs no longer leak the user's home lab.

- HOWTO.md: cameleer.siegeln.net OIDC example → cameleer.example.com;
  loader-image default in env-var table → registry.cameleer.io (matches
  the production default flipped in the previous commit); k3s service-URL
  table 192.168.50.86 → <your-cluster-host>
- ui/README.md: dev-server VITE_API_TARGET example LAN IP → host placeholder
- ui/vite.config.ts: api.cameleer.siegeln.net comment → api.cameleer.example.com

Out of scope (intentionally kept on internal infra):
- ui/package.json dev:remote and generate-api:live LAN IPs (dev-team
  convenience scripts)
- pom.xml, .npmrc, ui/Dockerfile (buildtime registry)
- deploy/* manifests (internal k3s)
- CLAUDE.md and .claude/rules/cicd.md (handled in the next commit, which
  also adds the buildtime/public split clarification)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

HOWTO.md

@@ -238,7 +238,7 @@ Logto is proxy-aware via `TRUST_PROXY_HEADER=1`. The `LOGTO_ENDPOINT` and `LOGTO
    - Note the **Client ID**
 3. **Create API Resource**: API Resources → Create
    - Name: `Cameleer Server API`
-   - Indicator: your API URL (e.g., `https://cameleer.siegeln.net/api`)
+   - Indicator: your API URL (e.g., `https://cameleer.example.com/api`)
    - Add permissions: `server:admin`, `server:operator`, `server:viewer`
 4. **Create M2M application** (for SaaS platform): Applications → Create → Machine-to-Machine
    - Name: `Cameleer SaaS`
@@ -496,7 +496,7 @@ Key settings in `cameleer-server-app/src/main/resources/application.yml`. All cu
 | `cameleer.server.runtime.dockernetwork` | `cameleer` | `CAMELEER_SERVER_RUNTIME_DOCKERNETWORK` | Primary Docker network |
 | `cameleer.server.runtime.dockerruntime` | *(empty = auto)* | `CAMELEER_SERVER_RUNTIME_DOCKERRUNTIME` | Container runtime override. Empty auto-detects gVisor (`runsc`) when registered with the daemon and falls back to the daemon default. Set to e.g. `kata` to force a specific runtime, or `runc` to force the default even if `runsc` is installed. |
 | `cameleer.server.runtime.jarstoragepath` | `/data/jars` | `CAMELEER_SERVER_RUNTIME_JARSTORAGEPATH` | JAR file storage directory (used by `FilesystemArtifactStore`) |
-| `cameleer.server.runtime.loaderimage` | `gitea.siegeln.net/cameleer/cameleer-runtime-loader:latest` | `CAMELEER_SERVER_RUNTIME_LOADERIMAGE` | Init-container image that fetches the JAR via signed URL |
+| `cameleer.server.runtime.loaderimage` | `registry.cameleer.io/cameleer/cameleer-runtime-loader:latest` | `CAMELEER_SERVER_RUNTIME_LOADERIMAGE` | Init-container image that fetches the JAR via signed URL |
 | `cameleer.server.runtime.artifacttokenttlseconds` | `600` | `CAMELEER_SERVER_RUNTIME_ARTIFACTTOKENTTLSECONDS` | TTL (seconds) for HMAC-signed artifact-download URLs |
 | `cameleer.server.runtime.artifactbaseurl` | *(empty)* | `CAMELEER_SERVER_RUNTIME_ARTIFACTBASEURL` | Base URL the loader uses to reach the server. Blank falls back to `serverurl`, then `http://cameleer-server:8081`. Must be reachable from the loader container's primary Docker network. |
 | `cameleer.server.runtime.routingmode` | `path` | `CAMELEER_SERVER_RUNTIME_ROUTINGMODE` | `path` or `subdomain` Traefik routing |
@@ -591,10 +591,10 @@ cameleer-demo namespace:
 
 | Service | URL |
 |---------|-----|
-| Web UI | `http://192.168.50.86:30090` |
-| Server API | `http://192.168.50.86:30081/api/v1/health` |
-| Swagger UI | `http://192.168.50.86:30081/api/v1/swagger-ui.html` |
-| Deploy Demo | `http://192.168.50.86:30092` |
+| Web UI | `http://<your-cluster-host>:30090` |
+| Server API | `http://<your-cluster-host>:30081/api/v1/health` |
+| Swagger UI | `http://<your-cluster-host>:30081/api/v1/swagger-ui.html` |
+| Deploy Demo | `http://<your-cluster-host>:30092` |
 | Logto API | `LOGTO_ENDPOINT` secret (NodePort 30951 direct, or behind reverse proxy) |
 | Logto Admin | `LOGTO_ADMIN_ENDPOINT` secret (NodePort 30952 direct, or behind reverse proxy) |
 

ui/README.md

@@ -12,7 +12,7 @@ npm run dev
 By default the dev server proxies `/api/*` to `http://localhost:8081`. To proxy to a remote server instead:
 
 ```bash
-VITE_API_TARGET=http://192.168.50.86:30081 npm run dev
+VITE_API_TARGET=http://your-backend-host:8081 npm run dev
 ```
 
 No CORS issues — Vite's proxy makes API calls server-side.

ui/vite.config.ts

@@ -2,7 +2,7 @@ import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 
 // Use VITE_API_TARGET to proxy to a remote server, e.g.:
-//   VITE_API_TARGET=https://api.cameleer.siegeln.net npm run dev
+//   VITE_API_TARGET=https://api.cameleer.example.com npm run dev
 const apiTarget = process.env.VITE_API_TARGET || 'http://localhost:8081';
 
 export default defineConfig({