Dockerize SSO Manager (all-in-one image) + GitHub Pages docs

All-in-one Dockerfile.openldap bundling the app + OpenLDAP + Redis in one
container, plus an idempotent bare-metal install.sh, and a Jekyll docs site
for GitHub Pages:
- Dockerfile.openldap (node:20-alpine; openldap + pw-sha2/ppolicy/memberof/
  refint; dumb-init PID 1; npm ci --omit=dev; tos.md copied to /).
- docker-entrypoint.sh: generate slapd.conf (mdb + overlays + TLS + indexes +
  access), self-signed LDAPS cert, seed directory tree + required groups,
  bundled redis, export app_* config, exec node.
- docker-compose.yml, .dockerignore, DEPLOYMENT.md, secrets.js.example.
- install.sh: idempotent Debian/Ubuntu bare-metal installer (Node 20.x,
  OpenLDAP, Redis, systemd unit) with flags + --dry-run/--skip-ldap/--skip-app.
- ops/ldif/: memberof/refint/tls/index/nodes/logging LDIFs.
- nodejs/conf/base.js: generic defaults (dc=example,dc=com / localhost /
  SSO Manager) so per-deployment values move to secrets.js or app_* env.
- nodejs/package.json: bump @simpleworkjs/conf to ^1.1.0 (app_* env overrides).
- nodejs/routes/index.js: /health endpoint for healthchecks.
- docs/: _config.yml + index/deployment/configuration/oauth/ldap pages
  (jekyll-theme-cayman) for GitHub Pages from /docs.

Co-Authored-By: Claude <noreply@anthropic.com>

ops/ldif/add_index.ldif

@@ -0,0 +1,3 @@
+dn: olcDatabase={1}mdb,cn=config
+add: olcDbIndex
+olcDbIndex: mail eq,sub

ops/ldif/add_nodes.ldif

@@ -0,0 +1,7 @@
+dn: ou=people,dc=theta42,dc=com
+objectClass: organizationalUnit
+ou: People
+
+dn: ou=groups,dc=theta42,dc=com
+objectClass: organizationalUnit
+ou: Groups

ops/ldif/logging.ldif

@@ -0,0 +1,4 @@
+dn: cn=config
+changetype: modify
+replace: olcLogLevel
+olcLogLevel: stats

ops/ldif/memberOfmodule.ldif

@@ -0,0 +1,4 @@
+dn: cn=module{0},cn=config
+changetype: modify
+add: olcModuleLoad
+olcModuleLoad: memberof.la

ops/ldif/memberof_config.ldif

@@ -0,0 +1,17 @@
+dn: cn=module,cn=config
+cn: module
+objectClass: olcModuleList
+olcModuleLoad: memberof
+olcModulePath: /usr/lib/ldap
+
+dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
+objectClass: olcConfig
+objectClass: olcMemberOf
+objectClass: olcOverlayConfig
+objectClass: top
+olcOverlay: memberof
+olcMemberOfDangling: ignore
+olcMemberOfRefInt: TRUE
+olcMemberOfGroupOC: groupOfNames
+olcMemberOfMemberAD: member
+olcMemberOfMemberOfAD: memberOf

ops/ldif/refinit1.ldif

@@ -0,0 +1,3 @@
+dn: cn=module{1},cn=config
+add: olcmoduleload
+olcmoduleload: refint

ops/ldif/refint2.ldif

@@ -0,0 +1,7 @@
+dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config
+objectClass: olcConfig
+objectClass: olcOverlayConfig
+objectClass: olcRefintConfig
+objectClass: top
+olcOverlay: {1}refint
+olcRefintAttribute: memberof member manager owner

ops/ldif/stuff.ldif

@@ -0,0 +1,26 @@
+# Entry 1: cn=stuff-manager,ou=groups,dc=theta42,dc=com
+dn: cn=stuff-manager,ou=groups,dc=theta42,dc=com
+cn: stuff-manager
+gidnumber: 1498
+objectclass: posixGroup
+objectclass: top
+
+# Entry 1: cn=stuff-manager,ou=people,dc=theta42,dc=com
+dn: cn=stuff-manager,ou=people,dc=theta42,dc=com
+cn: stuff-manager
+gidnumber: 1498
+givenname: Stuff
+homedirectory: /home/stuff-manager
+loginshell: /bin/bash
+objectclass: inetOrgPerson
+objectclass: sudoRole
+objectclass: ldapPublicKey
+objectclass: posixAccount
+objectclass: top
+sn: Manager
+sudocommand: ALL
+sudohost: ALL
+sudouser: stuff-manager
+uid: stuff-manager
+uidnumber: 1498
+userpassword: {MD5}YSv5lro/uQ0B7i81kGDPVQ==

ops/ldif/tls.ldif

@@ -0,0 +1,7 @@
+dn: cn=config
+changetype: modify
+replace: olcTLSCertificateFile
+olcTLSCertificateFile: /etc/ldap/sasl2/ldap-server.crt
+-
+replace: olcTLSCertificateKeyFile
+olcTLSCertificateKeyFile: /etc/ldap/sasl2/ldap-server.key