Dockerize SSO Manager (all-in-one image) + GitHub Pages docs

All-in-one Dockerfile.openldap bundling the app + OpenLDAP + Redis in one
container, plus an idempotent bare-metal install.sh, and a Jekyll docs site
for GitHub Pages:
- Dockerfile.openldap (node:20-alpine; openldap + pw-sha2/ppolicy/memberof/
  refint; dumb-init PID 1; npm ci --omit=dev; tos.md copied to /).
- docker-entrypoint.sh: generate slapd.conf (mdb + overlays + TLS + indexes +
  access), self-signed LDAPS cert, seed directory tree + required groups,
  bundled redis, export app_* config, exec node.
- docker-compose.yml, .dockerignore, DEPLOYMENT.md, secrets.js.example.
- install.sh: idempotent Debian/Ubuntu bare-metal installer (Node 20.x,
  OpenLDAP, Redis, systemd unit) with flags + --dry-run/--skip-ldap/--skip-app.
- ops/ldif/: memberof/refint/tls/index/nodes/logging LDIFs.
- nodejs/conf/base.js: generic defaults (dc=example,dc=com / localhost /
  SSO Manager) so per-deployment values move to secrets.js or app_* env.
- nodejs/package.json: bump @simpleworkjs/conf to ^1.1.0 (app_* env overrides).
- nodejs/routes/index.js: /health endpoint for healthchecks.
- docs/: _config.yml + index/deployment/configuration/oauth/ldap pages
  (jekyll-theme-cayman) for GitHub Pages from /docs.

Co-Authored-By: Claude <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,45 @@
+# Git
+.git
+.gitignore
+
+# Development
+.claude
+*.md
+# README.md and tos.md are both read at runtime (tos.md is loaded by
+# routes/index.js at boot), so they must stay in the build context.
+!README.md
+!tos.md
+
+# Tests
+nodejs/tests/
+nodejs/*.test.js
+
+# Host dependency tree — let the image run a clean `npm ci`. Also avoids
+# copying platform-wrong native modules (e.g. bcrypt built for the host OS).
+nodejs/node_modules
+
+# IDE
+.vscode
+.idea
+*.swp
+*.swo
+
+# Logs
+*.log
+logs/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Docker (prevent recursive copy)
+Dockerfile*
+docker-compose.yml
+.dockerignore
+
+# Ops scripts (not needed in container)
+ops/
+
+# Secrets (mount at runtime instead)
+nodejs/conf/secrets.js
+secrets.js