feat: initial jump-host — SSH jump host for the theta42 stack

An SSH jump host that authenticates users against the shared LDAP
directory, authorizes them from the SSO Manager's inventory graph, and
bridges them to downstream hosts — auditing everything.

- Username-grammar routing (uid_-_target@jump) + interactive TUI picker
- Inbound LDAP auth (publickey / password with off|local|all policy)
- Directory-driven access (LDAP groups x /api/discovery/resources?group=)
- Per-user key injection into sshPublicKey, connects downstream as the user
- Shell / exec / SFTP-subsystem bridging (WinSCP works)
- Web UI + HTTP API (:3002) for audit + metrics; LDAP-admin gated
- Packaged like proxy: ops/install.sh + systemd, all-in-one Docker, compose
- Tests: 23 unit + 3 integration (node --test), all green

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-entrypoint.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Start the theta42/jump-host all-in-one container: Redis (background) + the
+# Node app (foreground, PID 2 under dumb-init so it gets SIGTERM).
+set -e
+
+info() { echo "[INFO] $*"; }
+
+# When the unified theta-env stack (or any deployment) bind-mounts
+# ./config/jump-secrets.js at /config, point CONF_SECRETS at it.
+if [[ -f /config/jump-secrets.js ]]; then
+	export CONF_SECRETS=/config/jump-secrets.js
+	info "Loaded config from /config/jump-secrets.js"
+fi
+
+# Redis for audit/metrics/session storage (app connects to 127.0.0.1:6379).
+info "Starting redis..."
+redis-server --daemonize yes --save '' --appendonly no
+
+# Wait for redis to answer before starting the app.
+for _ in $(seq 1 20); do
+	if redis-cli ping >/dev/null 2>&1; then break; fi
+	sleep 0.2
+done
+
+export NODE_ENV="${NODE_ENV:-production}"
+info "Starting jump-host (SSH :${JUMP_SSH_PORT:-2222}, web :3002)..."
+exec "$@"