docs: direct LDAP binds are first-class, not "legacy"

Linux hosts are a primary consumer of the directory — PAM/SSSD login,
LDAP-backed sudo rules (sudoRole), and SSH public keys (openssh-lpk) —
which is exactly what the custom schemas exist for. Describe LDAPS /
StartTLS consumers as "Linux hosts and LDAP-native apps" instead of
"legacy apps" across README, DEPLOYMENT, docs, and the Dockerfile.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile.openldap

@@ -131,7 +131,8 @@ COPY ops/schema/openssh-lpk.schema /etc/openldap/schema/openssh-lpk.schema
 # 3001: SSO Manager web interface (HTTP — terminate TLS at the front proxy)
 # 389:  LDAP  (plain + StartTLS) — used internally by the app; map to host only
 #       if you want LAN clients to bind without TLS (not recommended).
-# 636:  LDAPS — for legacy apps / direct LDAP binds over the network (TLS)
+# 636:  LDAPS — direct LDAP binds over the network (TLS): Linux host auth
+#       (PAM/SSSD, sudo, SSH keys) and LDAP-native apps
 EXPOSE 3001 389 636
 
 # Health check