docs: clarify Logto proxy setup and ENDPOINT/ADMIN_ENDPOINT semantics

LOGTO_ENDPOINT and LOGTO_ADMIN_ENDPOINT are public-facing URLs that
Logto uses for OIDC discovery, issuer URI, and redirects. When behind
a reverse proxy (e.g., Traefik), set these to the external URLs.
Logto requires its own subdomain (not a path prefix).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/logto.yaml

@@ -1,8 +1,12 @@
 # Logto OIDC Provider for Cameleer
 # Provides external identity management with OAuth2/OIDC.
 #
+# Logto is proxy-aware: ENDPOINT and ADMIN_ENDPOINT (from logto-credentials secret)
+# set the public-facing URLs that Logto advertises in OIDC discovery, redirects, etc.
+# When behind a reverse proxy (e.g., Traefik), set these to the external URLs.
+#
 # After deployment:
-#   1. Access Logto admin console at http://192.168.50.86:30952
+#   1. Access Logto admin console at the ADMIN_ENDPOINT URL
 #   2. Complete initial setup (create admin account)
 #   3. Create an Application for Cameleer (see HOWTO.md)
 #   4. Create an API Resource with scopes (admin, operator, viewer)