feat(setup): first-run site join via CFG_MASTER_DIRECTORY_URL / CFG_MASTER_DIRECTORY_JOIN_KEY

Multi-site join wiring (server + UI landed in theta-directory v2.3.0):

- bootstrap/site-join.js: runs inside the sso-manager container (same
  self-contained rule as bootstrap.js); logs in as the bootstrap admin and calls
  /api/site/join. Idempotent: an already-joined node reports 'already a spoke'.
- setup.sh step 5b: if setup.env sets CFG_MASTER_DIRECTORY_URL +
  CFG_MASTER_DIRECTORY_JOIN_KEY, run the join after the bootstrap. Only honored
  on first run (ensure_config reads setup.env once and ignores it once
  ./config/ exists), so an already-populated directory can never be merged.
- setup.env.example documents both vars.
- lint.yml also node --check's site-join.js.

setup.env.example

@@ -48,6 +48,17 @@ CFG_DOMAIN=example.com
 # under an OU-style prefix). Leave unset to use the DN built from CFG_DOMAIN:
 #CFG_BASE_DN=dc=example,dc=com
 
+# ── Multi-Site: join an existing (master) directory ──────────────────────────
+# To run THIS deployment as a read-only SPOKE of an existing Theta Directory
+# instead of seeding a fresh one, set the master's URL and a site join key
+# (mint one on the master: Directory -> the Master Site modal -> Site Join Keys
+# -> Mint key). Honored ONLY on a first-run bring-up (before ./config/ exists),
+# so it can never merge an already-populated directory; re-runs ignore it.
+# The spoke adopts the master's users/groups/resources and persists its spoke
+# role in ./config/site.json (isMaster=false, masterUrl, siteSlug).
+#CFG_MASTER_DIRECTORY_URL=https://sso.master.example.com
+#CFG_MASTER_DIRECTORY_JOIN_KEY=stj_9f2e...
+
 # ── Optional outbound HTTP(S) proxy ──────────────────────────────────────────
 # For an isolated/offline/corporate-network test host that only reaches the
 # internet through an upstream HTTP proxy — NOT the theta42 "proxy" app.