Rewrite install.sh as a git-clone installer, add a one-line install

Replaces the old flag-driven, copy-based installer with an idempotent
git-clone-and-symlink installer matching theta42/proxy's ops/install.sh
pattern, so `wget -O - .../install.sh | sudo bash` works the same way
for both apps:

- Installs to /opt/theta42/sso-manager (was /opt/sso-manager, and the
  repo had to already be checked out locally -- now it clones itself).
- First run only: bootstraps OpenLDAP (modules, overlays, schema,
  directory tree, SSO groups -- ops/ldap-setup.sh) with a generated
  admin password + JWT secret, and seeds /etc/sso-manager/secrets.js
  (was /opt/sso-manager/conf/secrets.js, hand-filled from CLI flags).
  Later runs never touch LDAP or the secrets file again.
- ops/systemd/sso-manager.service now points at the new install path
  and sets CONF_SECRETS=/etc/sso-manager/secrets.js (requires
  @simpleworkjs/conf >= 1.2.0, already the pinned version) instead of
  the app needing a config file inside the repo checkout.
- Prints the version it's updating from/to (or "Already up to date")
  on every run, instead of updating silently.

Two real bugs found and fixed while testing this end-to-end in a clean
container:
- The debconf `slapd/domain` value was computed as
  `${LDAP_BASE_DN#dc=}` ("example,dc=com" for "dc=example,dc=com")
  instead of a proper dotted domain -- slapd's postinst hangs
  indefinitely on a malformed domain instead of failing cleanly.
  Fixed to derive it the same way the secrets file already did
  ("example.com").
- ops/ldap-setup.sh's ppolicy-overlay checks used an LDAP substring
  filter, `(olcOverlay=*ppolicy*)`, against an attribute that doesn't
  support substring matching -- it silently matched nothing even when
  the overlay was correctly configured (stored as "{0}ppolicy"),
  so the final verification always reported failure and `set -e`
  aborted the installer after LDAP was set up but before the app was.
  Fixed to filter on `(objectClass=olcOverlayConfig)` and let the
  existing DN-based grep narrow it down, matching the pattern already
  used by every other check in that script.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -107,23 +107,24 @@ vars, LDAPS/TLS, and backups.
 
 ### 3. Bare metal on Debian/Ubuntu
 
-`install.sh` is an idempotent installer: it installs Node.js 20.x and OpenLDAP,
-configures the directory (modules, overlays, schema, the SSO groups), deploys
-the app to `/opt/sso-manager`, and creates a systemd unit.
-
-The only thing it requires is the LDAP admin password; the domain (base DN)
-defaults to `dc=example,dc=com` if you don't pass one:
+An automated installer installs Node.js, Redis, and (on first run) OpenLDAP —
+configuring the directory (modules, overlays, schema, the SSO groups) and
+seeding `/etc/sso-manager/secrets.js` with a generated admin password and JWT
+secret — then deploys the app to `/opt/theta42/sso-manager` and starts a
+systemd service:
 
 ```bash
-sudo ./install.sh -p 'your-ldap-password' -b 'dc=yourdomain,dc=com'
-sudo systemctl enable --now sso-manager
-curl http://localhost:3001/health    # -> {"status":"ok"}
+wget -O - https://raw.githubusercontent.com/theta42/sso-manager-node/master/install.sh | sudo bash
 ```
 
-Run `sudo ./install.sh -h` for all flags (`-n` org name, `-o` port, `-j` JWT
-secret, `-s` SMTP, `--skip-ldap` to use an existing LDAP, `--dry-run`). Re-run
-it to update. Full details in [DEPLOYMENT.md](DEPLOYMENT.md) under *Method 2:
-Bare metal*.
+That's it — LDAP and the app are both live afterward. Edit
+`/etc/sso-manager/secrets.js` (org name, SMTP, a non-default base DN, ...) and
+restart the service to customize. It's idempotent and safe to re-run —
+re-running it updates the app in place (never touching LDAP or the secrets
+file again) and prints the version you're updating from and to (e.g. `Updated
+v1.1.13 -> v1.1.14`), or `Already up to date` if there's nothing new. Full
+details, including env var overrides (`LDAP_BASE_DN`, `SKIP_LDAP`, ...), in
+[DEPLOYMENT.md](DEPLOYMENT.md) under *Method 2: Bare metal*.
 
 ## Architecture