docs: correct loader-network reachability claim; refresh HOWTO env vars

Final-review must-fixes:
- HOWTO.md: drop CAMELEER_SERVER_RUNTIME_JARDOCKERVOLUME; add the three new
  artifact env vars (loaderimage / artifacttokenttlseconds / artifactbaseurl).
- DeploymentExecutor @PostConstruct WARN, handoff doc, and docker-orchestration
  rule no longer claim the loader uses cameleer-traefik. The loader runs on
  the PRIMARY Docker network only — additional networks are attached after
  startContainer returns, by which time the loader has exited. SaaS still
  works because the tenant's primary network hosts the tenant server.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cameleer-server-app/src/main/java/com/cameleer/server/app/runtime/DeploymentExecutor.java

@@ -111,9 +111,12 @@ public class DeploymentExecutor {
         if (artifactBaseUrl.isBlank() && globalServerUrl.isBlank()) {
             log.warn("Neither cameleer.server.runtime.artifactbaseurl nor cameleer.server.runtime.serverurl is set. "
                     + "Loader containers will fall back to http://cameleer-server:8081 — this requires the loader's "
-                    + "Docker network to resolve `cameleer-server`. In SaaS mode the server is on `cameleer-traefik` "
-                    + "which is added as an additional network for tenant containers, so this works. For other "
-                    + "deployment topologies, set CAMELEER_SERVER_RUNTIME_ARTIFACTBASEURL explicitly.");
+                    + "PRIMARY Docker network (CAMELEER_SERVER_RUNTIME_DOCKERNETWORK) to resolve `cameleer-server`. "
+                    + "Additional networks (e.g. cameleer-traefik) are attached AFTER startContainer returns, by "
+                    + "which time the loader has already exited — they are not available to the loader. In SaaS "
+                    + "mode the tenant primary network (cameleer-tenant-{slug}) hosts the tenant's server, so this "
+                    + "works. For other topologies, set CAMELEER_SERVER_RUNTIME_ARTIFACTBASEURL to a URL the loader "
+                    + "can reach over the primary network.");
         }
     }