feat: propagate CFG_LDAPS_HOST through setup and document LDAPS networking (#71)

Pass optional CFG_LDAPS_HOST from setup.env through setup.sh into the
generated ./config/sso-secrets.js as ldap.ldapsHost. This lets operators
advertise an internal-only LDAPS hostname (e.g. ldap.internal.example.com
or sso-manager) on the SSO /integrations page instead of the public
OAuth issuer, avoiding a public 636 port forward.

- setup.env.example: add CFG_LDAPS_HOST
- setup.sh: read/forward CFG_LDAPS_HOST into sso-secrets.js
- config.example/sso-secrets.js.example: document ldapsHost/ldapsPort
- .env.example: add LDAPS_HOST for legacy .env migrations
- docker-compose.yml: comment warning against public 636 forwarding
- README.md: explain CFG_LDAPS_HOST recommendation
- CHANGELOG.md + bump version to 1.1.19

Co-authored-by: Claude <noreply@anthropic.com>

setup.env.example

@@ -36,6 +36,12 @@ CFG_DOMAIN=example.com
 #CFG_ADMIN_UID=admin            # initial SSO admin username
 #CFG_ADMIN_EMAIL=admin@proxy.example.com   # defaults to admin@<proxyHost>
 #CFG_LDAP_CERT_CN=              # LDAP TLS cert CN; empty -> defaults to the domain
+#
+# Hostname advertised on the SSO /integrations page for direct LDAPS binds.
+# Leave blank to derive it from the public SSO host (same as oauth.issuer).
+# Recommended: set an internal-only name like 'ldap.internal.example.com' or
+# 'sso-manager' so clients don't need a public 636 port forward. See docs.
+#CFG_LDAPS_HOST=
 
 # Optional SMTP (outbound email from the SSO app). Leave blank to disable:
 #CFG_SMTP_HOST=smtp.example.com