feat(setup): enter the domain once via setup.env; stop drifting the secrets (#16)

The first-run flow generated ./config/*.js with example.com/dc=example,dc=com
defaults and then exit 0'd, telling the operator to hand-edit. The domain/base
DN was repeated across ~9 fields in each secrets file; on the deploy host only
the stack block was updated (to dc=718it,dc=biz) while ldap.* DNs stayed at
dc=example,dc=com, so slapd's root DN didn't match the app's bindDN and
bootstrap failed with 401 Invalid Credentials.

Enter the domain once: a new setup.env (gitignored; setup.env.example is the
committed template) holds the essential, non-repeating first-run info — the
domain as an LDAP base DN (CFG_BASE_DN). setup.sh reads it ONLY on first run
(when ./config/*.js don't exist), derives hostnames (sso.<domain> /
proxy.<domain>) and all LDAP DNs from it, generates both secrets files with
the real domain filled in everywhere + random secrets, and proceeds to build
in the same run (no edit-and-re-run step). After first run the secrets files
are operator-owned and setup.env is ignored — the apps and secrets files are
unchanged.

- setup.sh ensure_config: source setup.env -> bind CFG_* to empty (set -u
  safe) -> unchanged .env/proxy.env legacy migration -> derive from base DN
  (no example.com defaults; die with a helpful msg if CFG_BASE_DN blank) ->
  generate + proceed. Header comments updated.
- setup.env.example: committed template; secrets stay out (generated into
  ./config/*.js).
- .gitignore: ignore setup.env (per-deployment).
- README.md + docs/quickstart.md: Quickstart now cp setup.env.example ->
  set CFG_BASE_DN -> ./setup.sh; domain-asked-once note in "Before you begin".
- Bump sso-manager-node gitlink to 11fb2c0 (docs PR #37: base-DN-is-the-one-
  domain-value note in sso-manager README/DEPLOYMENT/secrets.js.example).

Co-authored-by: Claude <noreply@anthropic.com>

setup.env.example

@@ -0,0 +1,45 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# setup.env — first-run setup for the theta-env stack.
+#
+# This file is used ONLY on the FIRST run of ./setup.sh, to generate
+# ./config/sso-secrets.js + ./config/proxy-secrets.js with your domain filled
+# in everywhere consistently. Once ./config/*.js exist they are operator-owned
+# (edit them directly; setup.env is ignored on later runs).
+#
+#   cp setup.env.example setup.env
+#   $EDITOR setup.env        # set CFG_BASE_DN below to your domain
+#   ./setup.sh               # generates ./config/ and builds the stack
+#
+# Copying this file to setup.env (gitignored) keeps your domain out of git.
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Your domain, as an LDAP base DN. THIS IS THE ONE PLACE THE DOMAIN IS ENTERED.
+# Everything else derives from it: the SSO/proxy hostnames default to
+# sso.<domain> / proxy.<domain>, and the LDAP DNs are cn=admin,<dn>,
+# ou=people,<dn>, ou=groups,<dn>. Required — setup.sh refuses to run without it.
+CFG_BASE_DN=dc=example,dc=com
+
+# Public hostnames. Optional — default to sso.<domain> / proxy.<domain> derived
+# from CFG_BASE_DN above. Uncomment and set only if your hostnames differ
+# (e.g. a different subdomain, or the domain isn't the bare apex):
+#CFG_SSO_HOST=sso.example.com
+#CFG_PROXY_HOST=proxy.example.com
+
+# Optional — sensible defaults if left blank:
+#CFG_ORG=SSO Manager            # app display name + outbound email org
+#CFG_ADMIN_UID=admin            # initial SSO admin username
+#CFG_ADMIN_EMAIL=admin@proxy.example.com   # defaults to admin@<proxyHost>
+#CFG_LDAP_CERT_CN=              # LDAP TLS cert CN; empty -> defaults to the domain
+
+# Optional SMTP (outbound email from the SSO app). Leave blank to disable:
+#CFG_SMTP_HOST=smtp.example.com
+#CFG_SMTP_PORT=587
+#CFG_SMTP_USER=noreply@example.com
+#CFG_SMTP_PASS=your-smtp-password
+#CFG_SMTP_FROM=SSO Manager <noreply@example.com>
+
+# ── DO NOT put secrets here ──────────────────────────────────────────────────
+# The LDAP admin password, JWT secret, admin password, and LDAP service-account
+# password are GENERATED (random) into ./config/sso-secrets.js on first run.
+# Change them later by editing ./config/sso-secrets.js directly. Do NOT set
+# CFG_LDAP_ADMIN_PASS / CFG_JWT_SECRET / CFG_ADMIN_PASS / CFG_SVC_PASS here.