Rewrite install.sh as a git-clone installer, add a one-line install

Replaces the old flag-driven, copy-based installer with an idempotent
git-clone-and-symlink installer matching theta42/proxy's ops/install.sh
pattern, so `wget -O - .../install.sh | sudo bash` works the same way
for both apps:

- Installs to /opt/theta42/sso-manager (was /opt/sso-manager, and the
  repo had to already be checked out locally -- now it clones itself).
- First run only: bootstraps OpenLDAP (modules, overlays, schema,
  directory tree, SSO groups -- ops/ldap-setup.sh) with a generated
  admin password + JWT secret, and seeds /etc/sso-manager/secrets.js
  (was /opt/sso-manager/conf/secrets.js, hand-filled from CLI flags).
  Later runs never touch LDAP or the secrets file again.
- ops/systemd/sso-manager.service now points at the new install path
  and sets CONF_SECRETS=/etc/sso-manager/secrets.js (requires
  @simpleworkjs/conf >= 1.2.0, already the pinned version) instead of
  the app needing a config file inside the repo checkout.
- Prints the version it's updating from/to (or "Already up to date")
  on every run, instead of updating silently.

Two real bugs found and fixed while testing this end-to-end in a clean
container:
- The debconf `slapd/domain` value was computed as
  `${LDAP_BASE_DN#dc=}` ("example,dc=com" for "dc=example,dc=com")
  instead of a proper dotted domain -- slapd's postinst hangs
  indefinitely on a malformed domain instead of failing cleanly.
  Fixed to derive it the same way the secrets file already did
  ("example.com").
- ops/ldap-setup.sh's ppolicy-overlay checks used an LDAP substring
  filter, `(olcOverlay=*ppolicy*)`, against an attribute that doesn't
  support substring matching -- it silently matched nothing even when
  the overlay was correctly configured (stored as "{0}ppolicy"),
  so the final verification always reported failure and `set -e`
  aborted the installer after LDAP was set up but before the app was.
  Fixed to filter on `(objectClass=olcOverlayConfig)` and let the
  existing DN-based grep narrow it down, matching the pattern already
  used by every other check in that script.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

secrets.js.example

@@ -2,10 +2,14 @@
 
 // Example secrets configuration file (file-based config).
 //
-// Bare-metal: copy to nodejs/conf/secrets.js and fill in your values.
+// Bare-metal: install.sh seeds a filled-in version of this file at
+// /etc/sso-manager/secrets.js on first run (LDAP + JWT already live; only
+// SMTP is left as a placeholder). Only write this one by hand if you're
+// skipping install.sh's LDAP bootstrap (SKIP_LDAP=true) or setting up
+// manually.
 // Docker / unified stack: place at ./config/sso-secrets.js and bind-mount
-// ./config at /config (see docker-compose.yml); docker-entrypoint.sh symlinks
-// it into /app/conf/secrets.js so @simpleworkjs/conf reads it.
+// ./config at /config (see docker-compose.yml); docker-entrypoint.sh points
+// the CONF_SECRETS env var at it so @simpleworkjs/conf reads it.
 //
 // Values here override conf/base.js and win over <environment>.js. `app_*` env
 // vars (if any are set) override this file too — so the Docker stack passes NO