Persist Redis (AOF+vol), read config from mounted secrets.js, add backup/restore docs (#34)

Lossless upgrades + config story for the all-in-one image.

Redis persistence (Part A):
- Replace in-memory `--save "" --appendonly no` with AOF + RDB persisted to /data
  (--appendonly yes, periodic saves, --dbfilename dump.rdb). OAuth clients,
  tokens, and other model-redis state now survive container recreation.
- Add the `sso-data` named volume -> /data in docker-compose.yml.

Config from ./config/sso-secrets.js (Part B):
- docker-entrypoint.sh: when /config/sso-secrets.js is mounted, symlink it to
  /app/conf/secrets.js and read the server-side LDAP vars (base DN, admin pass,
  org, domain, cert CN, JWT) from the file via one `node` call (base64-decoded,
  no eval/quoting hazards). No app_* env is exported in this mode, so the file
  is authoritative (@simpleworkjs/conf precedence: base < env < secrets.js <
  app_* env). Falls back to the existing LDAP_* env-var mode when the file is
  absent (standalone/bare-metal still works).
- docker-compose.yml: trim `environment:` to NODE_ENV/NODE_PORT only and add
  `./config:/config:ro`. Removing the app_* env is required — any leftover
  app_* would silently override secrets.js.
- secrets.js.example: add orchestrator-only `stack`, `bootstrap`, and
  `serviceAccountPass` keys (ignored by the app; read by the entrypoint, the
  theta-env bootstrap, and setup.sh).

Backup/restore docs:
- Full "Backups and restore" runbook in DEPLOYMENT.md (what lives where,
  manual backup, full / Redis-only / LDAP-only restore, AOF-vs-RDB note,
  upgrades). Restore uses slapadd -f (static slapd.conf), and RDB restore
  requires deleting the AOF first (AOF wins on startup).
- Pointers in docs/deployment.md and docs/ldap.md; update the Docker Setup
  section for the new ./config/ approach (env vars now advanced/optional).

Co-authored-by: Claude <noreply@anthropic.com>

secrets.js.example

@@ -1,12 +1,20 @@
 'use strict';
 
-// Example secrets configuration file (file-based config, for non-Docker use).
-// Copy to nodejs/conf/secrets.js and fill in your values.
+// Example secrets configuration file (file-based config).
+//
+// Bare-metal: copy to nodejs/conf/secrets.js and fill in your values.
+// Docker / unified stack: place at ./config/sso-secrets.js and bind-mount
+// ./config at /config (see docker-compose.yml); docker-entrypoint.sh symlinks
+// it into /app/conf/secrets.js so @simpleworkjs/conf reads it.
 //
-// Docker users: you usually don't need this file — pass `app_*` env vars instead
-// (see DEPLOYMENT.md). This file is for bare-metal / mounted-config deployments.
 // Values here override conf/base.js and win over <environment>.js. `app_*` env
-// vars (if any are set) override this file too.
+// vars (if any are set) override this file too — so the Docker stack passes NO
+// app_* env, keeping this file authoritative.
+//
+// The app only reads the keys it knows (port, name, ldap, smtp, voipms, oauth).
+// The extra `stack`, `bootstrap`, and `serviceAccountPass` keys below are read
+// by the orchestrator (docker-entrypoint.sh, the bootstrap script, setup.sh)
+// and ignored by the app — safe to leave them out for bare-metal use.
 
 module.exports = {
     port: 3001,
@@ -39,4 +47,21 @@ module.exports = {
             refresh_token: 2592000       // 30 days in seconds
         }
     },
+
+    // ── Orchestrator-only keys (ignored by the app) ──────────────────────────
+    // Read by docker-entrypoint.sh (server-side slapd config + validation), the
+    // superproject bootstrap script, and setup.sh. Omit for bare-metal use.
+    stack: {
+        ldapBaseDn: 'dc=example,dc=com',   // slapd suffix (also drives seed OUs)
+        ldapDomain: 'example.com',         // default cert CN + OAuth issuer host
+        ldapCertCn: '',                    // cert CN; empty -> defaults to ldapDomain
+        ssoHost: 'sso.example.com',        // public SSO hostname (OAuth issuer URL)
+        proxyHost: 'proxy.example.com',    // public proxy hostname
+    },
+    bootstrap: {
+        adminUid: 'admin',                 // initial SSO admin username
+        adminPass: 'change-me',            // initial SSO admin password
+        adminEmail: 'admin@example.com',   // initial SSO admin email
+    },
+    serviceAccountPass: 'change-me',       // LDAP password the proxy binds with
 };