docs: document that the domain/base DN is entered once (#37)

The base DN (stack.ldapBaseDn) is the single place the domain is set; the
LDAP DNs (bindDN/userBase/groupBase) and oauth.issuer all derive from it and
must stay consistent. Drifting them apart (leaving bindDN at dc=example,dc=com
while ldapBaseDn is the real domain) makes the SSO bind against a non-existent
root DN and every login fails with Invalid Credentials.

- secrets.js.example: clarifying comment at ldapBaseDn
- DEPLOYMENT.md: "domain entered once as the base DN" note + theta-env
  setup.env cross-link (merged the two duplicate theta-env blockquotes)
- README.md: cross-link to DEPLOYMENT.md from "Server set up"

Docs only; no app/secrets-structure change.

Co-authored-by: Claude <noreply@anthropic.com>

README.md

@@ -9,6 +9,12 @@ The server requires:
 * NodeJS 13.x
 * LDAP server
 
+> Setting up the whole stack (Docker) or want the secrets-file layout? See
+> [DEPLOYMENT.md](DEPLOYMENT.md) — your domain is entered **once**, as the LDAP
+> base DN (`stack.ldapBaseDn`); the LDAP DNs (`bindDN`/`userBase`/`groupBase`)
+> and `oauth.issuer` all derive from it and must stay consistent. Running the
+> unified `theta-env` stack, `setup.sh` fills those in for you from `setup.env`.
+
 ### OpenLDAP configuration
 
 #### Password hashing (required)