Release 1.11.0: end-user catalog, access requests, nested groups

Closes the end-user half of the directory and adds nested LDAP groups.

The directory could describe the lab but could not tell anyone what they had
or how to reach it, and several of the paths meant to do so were silently
returning nothing:

  - GET /api/discovery/me resolved groups from req.user.groups, which does not
    exist (req.user carries memberOf), so it returned only isPublic resources
    for every human caller -- "My Services" was blank for everyone. The same
    read made isDirectoryAdmin() false for real admins.
  - The portal's "Discover More Services" called the admin-gated endpoint and
    swallowed the 403, so it never rendered for non-admins at all.
  - Services reported no address, because /me had reimplemented getMyAccess
    without its parent-walking resolution.

Adds the catalog at /, self-service access requests, and admin access
visibility (per-resource counts, and the reverse "what can this user reach").

Nested groups come in two halves. groupOfNames.member already accepts a group
DN, so nesting needs no schema -- what it needs is resolution, which no
released OpenLDAP performs. The all-in-one image therefore builds slapd from a
pinned master commit for the nestgroup overlay, and the app computes the
closure itself when pointed at a server without it. Both paths are covered.

member-values is deliberately left out of nestgroup-flags: it expands `member`
when reading a group, which destroys the distinction between "listed here" and
"reachable through a nested group" and is not recoverable afterwards.

Full suite green in both resolution modes: 215 passed, 2 skipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nodejs/conf/base.js

@@ -29,6 +29,11 @@ module.exports = {
 		// public 636 port forward. See docs/ldap.md.
 		ldapsHost: '',
 		ldapsPort: 636,
+		// True when slapd carries the `nestgroup` overlay, which resolves nested
+		// groups server-side. Set automatically by docker-entrypoint.sh for the
+		// all-in-one image; leave false when pointing at a stock OpenLDAP (no
+		// 2.6.x release ships nestgroup) and the app resolves nesting itself.
+		nestedGroupsServerSide: false,
 		// New users/personal groups (see addPosixAccount/addPosixGroup in
 		// models/user_ldap.js) get the next uid/gidNumber >= uidGidMin.
 		// Existing entries >= uidGidReservedFloor are ignored when computing
@@ -60,6 +65,16 @@ module.exports = {
 		pass: '__in secrets file__',
 		from: 'SSO Manager <noreply@example.com>',
 	},
+	directory: {
+		// Public SSH jump host fronting the lab, if there is one (the jump-host
+		// component). When set, a host card in the catalog shows the real
+		// invocation — `ssh <uid>_-_<slug>@<jumpHost>` — instead of a bare
+		// `ssh <uid>@<ip>` that only works from inside the LAN. Empty is fine;
+		// the card falls back to the direct form.
+		jumpHost: '',
+		// Default SSH port assumed when a host carries no metadata.sshPort.
+		defaultSshPort: 22,
+	},
 	service: {
 		updateCheck: {
 			enabled: true,