Dockerize SSO Manager (all-in-one image) + GitHub Pages docs

All-in-one Dockerfile.openldap bundling the app + OpenLDAP + Redis in one
container, plus an idempotent bare-metal install.sh, and a Jekyll docs site
for GitHub Pages:
- Dockerfile.openldap (node:20-alpine; openldap + pw-sha2/ppolicy/memberof/
  refint; dumb-init PID 1; npm ci --omit=dev; tos.md copied to /).
- docker-entrypoint.sh: generate slapd.conf (mdb + overlays + TLS + indexes +
  access), self-signed LDAPS cert, seed directory tree + required groups,
  bundled redis, export app_* config, exec node.
- docker-compose.yml, .dockerignore, DEPLOYMENT.md, secrets.js.example.
- install.sh: idempotent Debian/Ubuntu bare-metal installer (Node 20.x,
  OpenLDAP, Redis, systemd unit) with flags + --dry-run/--skip-ldap/--skip-app.
- ops/ldif/: memberof/refint/tls/index/nodes/logging LDIFs.
- nodejs/conf/base.js: generic defaults (dc=example,dc=com / localhost /
  SSO Manager) so per-deployment values move to secrets.js or app_* env.
- nodejs/package.json: bump @simpleworkjs/conf to ^1.1.0 (app_* env overrides).
- nodejs/routes/index.js: /health endpoint for healthchecks.
- docs/: _config.yml + index/deployment/configuration/oauth/ldap pages
  (jekyll-theme-cayman) for GitHub Pages from /docs.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/index.md

@@ -0,0 +1,105 @@
+---
+layout: default
+title: Home
+---
+
+# SSO Manager
+
+A self-hosted **OpenID Connect provider** with a bundled **OpenLDAP directory**
+and a web management UI — for home labs and small businesses that want their
+own identity provider instead of a hosted one.
+
+## Features
+
+- **OpenID Connect / OAuth 2.0 provider** — issue your own access/refresh/id
+  tokens; protect your apps with OIDC login.
+- **OpenLDAP directory** — users, groups, POSIX accounts (`posixAccount`/
+  `inetOrgPerson`), SSH public keys, and sudo roles, with `memberOf` +
+  referential-integrity overlays.
+- **Web management UI** — manage users, groups, and OAuth clients from a
+  browser; invite/password-reset flows over email.
+- **LDAPS for legacy apps** — apps that bind LDAP directly (Gitea, Emby, …)
+  can use LDAPS (636) / StartTLS.
+- **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or
+  run each piece separately via `app_*` env config.
+
+## Quick Start
+
+### Docker (all-in-one)
+
+```bash
+git clone https://github.com/theta42/sso-manager-node.git
+cd sso-manager-node
+cp secrets.js.example nodejs/conf/secrets.js   # edit it, or use app_* env
+docker compose up -d --build
+```
+
+The web UI comes up at `http://localhost:3001`. See the
+[Deployment Guide](deployment.html) for the full set of `app_*` env vars.
+
+### Bare metal (Debian/Ubuntu)
+
+```bash
+sudo ./install.sh
+```
+
+Idempotent installer — installs Node.js, OpenLDAP, Redis, configures the app,
+and starts a systemd unit. Re-run to update.
+
+### Run it together with the proxy
+
+The proxy ([theta42/proxy](https://github.com/theta42/proxy)) fronts this SSO
+under TLS and protects it with OIDC, while also binding LDAP directly. Run both
+with one command via [theta-env](https://github.com/theta42/theta-env):
+
+```bash
+git clone --recursive https://github.com/theta42/theta-env.git
+cd theta-env && cp .env.example .env   # edit, then:
+./setup.sh
+```
+
+## Documentation
+
+- [Deployment Guide](deployment.html) — Docker + bare metal, the config layers,
+  the `app_*` env reference, backups.
+- [Configuration](configuration.html) — every `app_*` env var and the conf
+  merge order.
+- [OAuth / OIDC](oauth.html) — the provider: discovery, client management,
+  token lifetimes, scopes.
+- [LDAP](ldap.html) — directory layout, TLS, overlays, schema, direct-bind
+  service accounts.
+
+## Architecture
+
+```
+┌─────────────┐
+│  Browser /  │
+│  OIDC apps  │
+└──────┬──────┘
+       │ HTTP/HTTPS
+       ▼
+┌────────────────────────┐      ┌─────────────┐
+│  Express SSO Manager   │◄────►│   Redis     │
+│  - OIDC provider       │      │ - sessions  │
+│  - web UI (:3001)      │      │ - models    │
+│  - management API      │      └─────────────┘
+└────────┬───────────────┘
+         │ ldapi/ldap (localhost)
+         ▼
+┌────────────────────────┐
+│  OpenLDAP (slapd)      │
+│  - users / groups      │
+│  - LDAPS :636          │─── legacy apps bind directly
+│  - StartTLS :389       │
+└────────────────────────┘
+```
+
+## Community
+
+- [GitHub Repository](https://github.com/theta42/sso-manager-node)
+- [Issue Tracker](https://github.com/theta42/sso-manager-node/issues)
+- [Pull Requests](https://github.com/theta42/sso-manager-node/pulls)
+
+## License
+
+MIT License — see the repository for details.