fix: unify container/agent log identity and fix multi-replica log capture

Four logging pipeline fixes:

1. Multi-replica startup logs: remove stopLogCaptureByApp from
   SseConnectionManager — container log capture now expires naturally
   after 60s instead of being killed when the first agent connects SSE.
   This ensures all replicas' bootstrap output is captured.

2. Unified instance_id: container logs and agent logs now share the same
   instance identity ({envSlug}-{appSlug}-{replicaIndex}). DeploymentExecutor
   sets CAMELEER_AGENT_INSTANCEID per replica so the agent uses the same
   ID as ContainerLogForwarder. Instance-level log views now show both
   container and agent logs.

3. Labels-first container identity: TraefikLabelBuilder emits cameleer.replica
   and cameleer.instance-id labels. Container names are tenant-prefixed
   ({tenantId}-{envSlug}-{appSlug}-{idx}) for global Docker daemon uniqueness.

4. Environment filter on log queries: useApplicationLogs now passes the
   selected environment to the API, preventing log leakage across environments.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-core/src/main/java/com/cameleer3/server/core/runtime/RuntimeOrchestrator.java

@@ -11,11 +11,8 @@ public interface RuntimeOrchestrator {
     Stream<String> getLogs(String containerId, int tailLines);
 
     /** Start streaming container logs to ClickHouse. */
-    default void startLogCapture(String containerId, String appSlug, String envSlug, String tenantId) {}
+    default void startLogCapture(String containerId, String instanceId, String appSlug, String envSlug, String tenantId) {}
 
     /** Stop log capture for a specific container (e.g., on die/oom). */
     default void stopLogCapture(String containerId) {}
-
-    /** Stop log capture for all containers matching this app+env (e.g., on agent SSE connect). */
-    default void stopLogCaptureByApp(String appSlug, String envSlug) {}
 }