feat: optional SSH jump host component (theta42/jump-host)

Adds jump-host as a third, opt-in submodule, wired behind
CFG_JUMP_HOST_ENABLED (default off — existing installs unaffected):

- .gitmodules + jump-host submodule pinned to v1.0.0
- setup.sh: resolves the enable flag early, adds jump-host to the
  submodule tag-update loop and activates the `jump-host` compose
  profile when enabled; builds/starts the service after the proxy,
  waits for its /health, and registers its web UI as a proxy Host;
  passes CFG_JUMP_HOST_ENABLED/CFG_JUMP_HOST to the bootstrap
- docker-compose.yml: jump-host service with profiles:["jump-host"],
  depends_on sso-manager healthy, ports 2222 (SSH) + 3002 (web),
  ./config:ro + jump-data volume
- bootstrap.js: when enabled, mints a directory API token and writes
  ./config/jump-secrets.js (binds as cn=admin so it can write the
  sshPublicKey attribute for key injection), and seeds a directory
  service entry for the jump host. Warn-only, idempotent.
- setup.env.example: CFG_JUMP_HOST_ENABLED / CFG_JUMP_HOST / JUMP_SSH_PORT

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

setup.env.example

@@ -33,6 +33,18 @@ CFG_DOMAIN=example.com
 #CFG_SSO_HOST=sso.example.com
 #CFG_PROXY_HOST=proxy.example.com
 
+# ── Optional SSH jump host ───────────────────────────────────────────────────
+# Enable the theta42/jump-host component: a public SSH jump host that
+# authenticates users against the directory and bridges them to downstream
+# hosts (ssh uid_-_target@jump, or an interactive picker). Off by default.
+# When true, setup.sh clones/builds the jump-host submodule, the bootstrap
+# mints its directory API token + writes ./config/jump-secrets.js, and it's
+# registered in the proxy + directory. See jump-host's README for the LDAP
+# write-ACL note (the bundled deployment binds as cn=admin).
+#CFG_JUMP_HOST_ENABLED=false
+#CFG_JUMP_HOST=jump.example.com   # defaults to jump.<domain>
+#JUMP_SSH_PORT=2222               # host port mapped to the jump host's SSH (never 22 by default)
+
 # Advanced: override the derived LDAP base DN directly (e.g. to namespace
 # under an OU-style prefix). Leave unset to use the DN built from CFG_DOMAIN:
 #CFG_BASE_DN=dc=example,dc=com