feat: add cameleer.tenant label to deployed app containers

Allows the SaaS platform to identify and clean up all containers
belonging to a tenant on delete (cameleer/cameleer-saas#55).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/java/com/cameleer3/server/app/runtime/DeploymentExecutor.java

@@ -129,7 +129,7 @@ public class DeploymentExecutor {
             updateStage(deployment.id(), DeployStage.START_REPLICAS);
 
             Map<String, String> baseEnvVars = buildEnvVars(app, env, config);
-            Map<String, String> labels = TraefikLabelBuilder.build(app.slug(), env.slug(), config);
+            Map<String, String> labels = TraefikLabelBuilder.build(app.slug(), env.slug(), tenantId, config);
 
             List<Map<String, Object>> replicaStates = new ArrayList<>();
             List<String> newContainerIds = new ArrayList<>();

cameleer3-server-app/src/main/java/com/cameleer3/server/app/runtime/TraefikLabelBuilder.java

@@ -9,12 +9,13 @@ public final class TraefikLabelBuilder {
 
     private TraefikLabelBuilder() {}
 
-    public static Map<String, String> build(String appSlug, String envSlug, ResolvedContainerConfig config) {
+    public static Map<String, String> build(String appSlug, String envSlug, String tenantId, ResolvedContainerConfig config) {
         String svc = envSlug + "-" + appSlug;
         Map<String, String> labels = new LinkedHashMap<>();
 
         labels.put("traefik.enable", "true");
         labels.put("managed-by", "cameleer3-server");
+        labels.put("cameleer.tenant", tenantId);
         labels.put("cameleer.app", appSlug);
         labels.put("cameleer.environment", envSlug);