Rewrite install.sh as a git-clone installer, add a one-line install

Replaces the old flag-driven, copy-based installer with an idempotent
git-clone-and-symlink installer matching theta42/proxy's ops/install.sh
pattern, so `wget -O - .../install.sh | sudo bash` works the same way
for both apps:

- Installs to /opt/theta42/sso-manager (was /opt/sso-manager, and the
  repo had to already be checked out locally -- now it clones itself).
- First run only: bootstraps OpenLDAP (modules, overlays, schema,
  directory tree, SSO groups -- ops/ldap-setup.sh) with a generated
  admin password + JWT secret, and seeds /etc/sso-manager/secrets.js
  (was /opt/sso-manager/conf/secrets.js, hand-filled from CLI flags).
  Later runs never touch LDAP or the secrets file again.
- ops/systemd/sso-manager.service now points at the new install path
  and sets CONF_SECRETS=/etc/sso-manager/secrets.js (requires
  @simpleworkjs/conf >= 1.2.0, already the pinned version) instead of
  the app needing a config file inside the repo checkout.
- Prints the version it's updating from/to (or "Already up to date")
  on every run, instead of updating silently.

Two real bugs found and fixed while testing this end-to-end in a clean
container:
- The debconf `slapd/domain` value was computed as
  `${LDAP_BASE_DN#dc=}` ("example,dc=com" for "dc=example,dc=com")
  instead of a proper dotted domain -- slapd's postinst hangs
  indefinitely on a malformed domain instead of failing cleanly.
  Fixed to derive it the same way the secrets file already did
  ("example.com").
- ops/ldap-setup.sh's ppolicy-overlay checks used an LDAP substring
  filter, `(olcOverlay=*ppolicy*)`, against an attribute that doesn't
  support substring matching -- it silently matched nothing even when
  the overlay was correctly configured (stored as "{0}ppolicy"),
  so the final verification always reported failure and `set -e`
  aborted the installer after LDAP was set up but before the app was.
  Fixed to filter on `(objectClass=olcOverlayConfig)` and let the
  existing DN-based grep narrow it down, matching the pattern already
  used by every other check in that script.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ops/ldap-setup.sh

@@ -129,7 +129,7 @@ fi
 # ── 3. ppolicy overlay ────────────────────────────────────────────────────────
 info "ppolicy overlay"
 
-if config_search -b "$DB_DN" "(olcOverlay=*ppolicy*)" dn | grep -qi "^dn:.*ppolicy"; then
+if config_search -b "$DB_DN" "(objectClass=olcOverlayConfig)" dn | grep -qi "^dn:.*ppolicy"; then
     skip "ppolicy overlay already configured on ${DB_DN}"
 else
     config_add "dn: olcOverlay=ppolicy,${DB_DN}
@@ -280,7 +280,7 @@ info "verifying ppolicy is active on ${DB_DN}"
 
 VERIFY_FAILED=0
 
-if config_search -b "$DB_DN" "(olcOverlay=*ppolicy*)" dn | grep -qi "^dn:.*ppolicy"; then
+if config_search -b "$DB_DN" "(objectClass=olcOverlayConfig)" dn | grep -qi "^dn:.*ppolicy"; then
     ok "ppolicy overlay is attached to the user database"
 else
     warn "ppolicy overlay is NOT attached to ${DB_DN} — active/inactive toggle will fail"

ops/systemd/sso-manager.service

@@ -1,6 +1,7 @@
 [Unit]
-Description=SSO NodeJS manager Service
-After=network.target
+Description=Theta42 SSO Manager
+After=network.target slapd.service
+Wants=slapd.service
 StartLimitIntervalSec=0
 
 [Service]
@@ -8,7 +9,10 @@ Type=simple
 Restart=always
 RestartSec=1
 User=root
-ExecStart=/usr/bin/env node /var/www/sso-manager-node/nodejs/bin/www
+WorkingDirectory=/opt/theta42/sso-manager/nodejs
+Environment="NODE_ENV=production"
+Environment="CONF_SECRETS=/etc/sso-manager/secrets.js"
+ExecStart=/usr/bin/env node /opt/theta42/sso-manager/nodejs/bin/www
 
 [Install]
 WantedBy=multi-user.target