refactor: prefix all third-party service names with cameleer-

Rename all Docker/K8s service names, DNS hostnames, secrets, volumes,
and manifest files to use the cameleer- prefix, making it clear which
software package each container belongs to.

Services renamed:
- postgres → cameleer-postgres
- clickhouse → cameleer-clickhouse
- logto → cameleer-logto
- logto-postgresql → cameleer-logto-postgresql
- traefik (service) → cameleer-traefik
- postgres-external → cameleer-postgres-external

Secrets renamed:
- postgres-credentials → cameleer-postgres-credentials
- clickhouse-credentials → cameleer-clickhouse-credentials
- logto-credentials → cameleer-logto-credentials

Volumes renamed:
- pgdata → cameleer-pgdata
- chdata → cameleer-chdata
- certs → cameleer-certs
- bootstrapdata → cameleer-bootstrapdata

K8s manifests renamed:
- deploy/postgres.yaml → deploy/cameleer-postgres.yaml
- deploy/clickhouse.yaml → deploy/cameleer-clickhouse.yaml
- deploy/logto.yaml → deploy/cameleer-logto.yaml

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/SERVER-CAPABILITIES.md

@@ -293,7 +293,7 @@ This applies to both M2M tokens (`scope` claim) and OIDC user login (configurabl
 | Variable | Purpose |
 |----------|---------|
 | `CAMELEER_SERVER_SECURITY_OIDCISSUERURI` | OIDC issuer URI for token validation (e.g., `https://auth.example.com/oidc`) |
-| `CAMELEER_SERVER_SECURITY_OIDCJWKSETURI` | Direct JWKS URL (e.g., `http://logto:3001/oidc/jwks`) — use when public issuer isn't reachable from inside containers |
+| `CAMELEER_SERVER_SECURITY_OIDCJWKSETURI` | Direct JWKS URL (e.g., `http://cameleer-logto:3001/oidc/jwks`) — use when public issuer isn't reachable from inside containers |
 | `CAMELEER_SERVER_SECURITY_OIDCAUDIENCE` | Expected audience (API resource indicator) |
 | `CAMELEER_SERVER_SECURITY_OIDCTLSSKIPVERIFY` | Skip TLS certificate verification for OIDC calls (default `false`) — use when provider has a self-signed CA |
 

docs/superpowers/plans/2026-04-05-logto-oidc-resource-server.md

@@ -926,13 +926,13 @@ Logto is deployed alongside the Cameleer stack. After first deployment:
 5. **Configure Cameleer**: Use the admin API (`PUT /api/v1/admin/oidc`) or set env vars for initial seeding:
    ```
    CAMELEER_OIDC_ENABLED=true
-   CAMELEER_OIDC_ISSUER=http://logto:3001/oidc
+   CAMELEER_OIDC_ISSUER=http://cameleer-logto:3001/oidc
    CAMELEER_OIDC_CLIENT_ID=<client-id-from-step-2>
    CAMELEER_OIDC_CLIENT_SECRET=<not-needed-for-public-spa>
    ```
 6. **Configure resource server** (for M2M token validation):
    ```
-   CAMELEER_OIDC_ISSUER_URI=http://logto:3001/oidc
+   CAMELEER_OIDC_ISSUER_URI=http://cameleer-logto:3001/oidc
    CAMELEER_OIDC_AUDIENCE=https://cameleer.siegeln.net/api
    ```
 ```
@@ -948,7 +948,7 @@ Replace:
 
 With:
 ```json
-    "issuerUri": "http://logto:3001/oidc",
+    "issuerUri": "http://cameleer-logto:3001/oidc",
 ```
 
 - [ ] **Step 3: Update HOWTO.md — replace infrastructure diagram**

docs/superpowers/specs/2026-03-16-storage-layer-design.md

@@ -568,7 +568,7 @@ MetricsFlushScheduler (@Scheduled)
 ### Configuration
 
 Environment variables (existing pattern):
-- `SPRING_DATASOURCE_URL=jdbc:postgresql://postgres:5432/cameleer3`
+- `SPRING_DATASOURCE_URL=jdbc:postgresql://cameleer-postgres:5432/cameleer3`
 - `SPRING_DATASOURCE_USERNAME`, `SPRING_DATASOURCE_PASSWORD`
 - `OPENSEARCH_URL=http://opensearch:9200`
 - `CAMELEER_RETENTION_DAYS=30` (applies to both PostgreSQL and OpenSearch)

docs/superpowers/specs/2026-03-31-clickhouse-migration-design.md

@@ -746,7 +746,7 @@ public void enforceRetention() {
 
 ```yaml
 clickhouse:
-  url: jdbc:clickhouse://clickhouse:8123/cameleer?async_insert=1&wait_for_async_insert=0
+  url: jdbc:clickhouse://cameleer-clickhouse:8123/cameleer?async_insert=1&wait_for_async_insert=0
   username: cameleer_app
   password: ${CLICKHOUSE_PASSWORD}
 ```

docs/superpowers/specs/2026-04-05-logto-oidc-resource-server-design.md

@@ -186,7 +186,7 @@ Update PUT handler default: `rolesClaim` from `realm_access.roles` to `roles`.
 
 | Variable | Purpose | Required |
 |----------|---------|----------|
-| `CAMELEER_OIDC_ISSUER_URI` | Logto issuer URI (e.g., `http://logto:3001/oidc`) | No — when blank, no OIDC resource server |
+| `CAMELEER_OIDC_ISSUER_URI` | Logto issuer URI (e.g., `http://cameleer-logto:3001/oidc`) | No — when blank, no OIDC resource server |
 | `CAMELEER_OIDC_AUDIENCE` | Expected audience / API resource indicator | No — when blank, audience not validated |
 
 ## Files Changed