Load the theta42 (dateOfBirth) schema in the all-in-one image

The app (nodejs/models/user_ldap.js) adds objectClass theta42Person whenever a
user has a dateOfBirth, and lists it among every new user's objectClasses. But
the all-in-one image's static slapd.conf only included core/cosine/inetorgperson/
nis — never the project's own theta42 schema — so slapd rejects
objectClass: theta42Person with LDAP 0x15 (objectClass: value #0 invalid per
syntax). Symptom: PUT /api/user/<uid> (and user creation) failing.

ops/ldap-setup.sh loads this schema for bare-metal (as a cn=config LDIF); the
Docker image uses slapd.conf, so ship it as a .schema file and include it.

- ops/schema/theta42.schema: dateOfBirth attribute + theta42Person auxiliary
  objectClass (same OIDs/definition as ldap-setup.sh section 5).
- Dockerfile.openldap: COPY it to /etc/openldap/schema/theta42.schema.
- docker-entrypoint.sh: include it in the generated slapd.conf (after nis).

Co-Authored-By: Claude <noreply@anthropic.com>

Dockerfile.openldap

@@ -68,6 +68,13 @@ COPY tos.md /tos.md
 COPY docker-entrypoint.sh /usr/local/bin/
 RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
+# theta42 custom schema (dateOfBirth + theta42Person). The app adds
+# objectClass theta42Person when a user has a dateOfBirth, so the directory
+# must know it or user create/update fails with LDAP 0x15. Mirrors the
+# cn=config LDIF ops/ldap-setup.sh loads on bare metal, in .schema form so
+# docker-entrypoint.sh can `include` it in the static slapd.conf.
+COPY ops/schema/theta42.schema /etc/openldap/schema/theta42.schema
+
 # Expose ports
 # 3001: SSO Manager web interface (HTTP — terminate TLS at the front proxy)
 # 389:  LDAP  (plain + StartTLS) — used internally by the app; map to host only